anyfile-notepad.semaan.ca Open in urlscan Pro
172.105.61.58 Public Scan

Software

ESF /

Resource Hash

5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 17 Dec 2023 04:21:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 17 Dec 2023 04:21:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 17 Dec 2023 04:21:28 GMT

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
anyfile-notepad.semaan.ca/assets/ 300 KB
300 KB 757ms
752ms Stylesheet
text/css 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 3d9d832a8392beea801da416111f4da7a68a574fc4d0d64709b468a0f795f425

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:28 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: text/css; charset=utf-8
access-control-allow-origin: *
accept-ranges: bytes
content-length: 307287

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js Show response
anyfile-notepad.semaan.ca/assets/ 653 KB
653 KB 757ms
753ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: d05e631c8d0e5f8e85e4b97a33f40aeca825caa30783371af6d725f48e490c0e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:28 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 668241

GET
H2 200 ace.js Show response
anyfile-notepad.semaan.ca/ace.js/ 353 KB
353 KB 757ms
754ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/ace.js/ace.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: e9ce598bb515c234eb962bbafbd1128d45f6c2755538a9b5e04a72ee58ec333e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:28 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 360977
expires: 0

GET
H2 200 ext-language_tools.js Show response
anyfile-notepad.semaan.ca/ace.js/ 34 KB
34 KB 757ms
754ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/ace.js/ext-language_tools.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 91bfbf51e788250c288a29c462a958ec5a8c5ed80aa542dd2ef439eb4384de2e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:28 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 35073
expires: 0

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 89 KB
29 KB 135ms
59ms Script
text/javascript 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f157.1e100.net

Software

cafe /

Resource Hash

611afa62724b5809b1e60e094a440459cb09920771e3ca59f2520771ff706ea6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
server: cafe
etag: 0 / 19708 / m202312060101 / config-hash: 17400476758908410755
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 04:21:28 GMT

GET
H2 200 sdbmtiqbxqoopp7t3s9lq.js Show response
storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/ 170 KB
170 KB 199ms
125ms Script
text/javascript 172.253.63.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f207.1e100.net
Software: UploadServer /
Resource Hash: 08b280a4f0643253a52d633ead8ba7441919dd32155433b061a6032d31453b7b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:28 GMT
x-guploader-uploadid: ABPtcPpw3n7IDSsAKheX9pk4x1uimcCKdRlOp5thM-kbRypEgDJ3jfNoB_bydZV4YM9StZMjOIo
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174265
last-modified: Sun, 17 Dec 2023 04:20:10 GMT
server: UploadServer
etag: "3ef537fdfae0face6e220c8bb8cc728e"
x-goog-generation: 1702786810277259
content-type: text/javascript
x-goog-hash: crc32c=Oug7Sw==, md5=PvU3/frg+s5uIgyLuMxyjg==
cache-control: public, max-age=3600
x-goog-stored-content-length: 174265
accept-ranges: bytes
expires: Sun, 17 Dec 2023 05:21:28 GMT

GET
H2 200 vdbmtiqbxqoopp7t3s9lq.js Show response
storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/ 3 KB
3 KB 164ms
90ms Script
text/javascript 172.253.63.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/vdbmtiqbxqoopp7t3s9lq.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f207.1e100.net
Software: UploadServer /
Resource Hash: f021848a846c74438092d280daa4bd2fbf31da24198db5940a8314898bdfc296

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:28 GMT
x-guploader-uploadid: ABPtcPruYogW6T2gs8xTUGvZwwWVkeFiIhRc7RIxzpabIMt5xB4-LQKlMswKSuKfDr09Jp9VDrk
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2652
last-modified: Sun, 17 Dec 2023 04:20:10 GMT
server: UploadServer
etag: "aa9a8313552d27362417cdff6cbd47f6"
x-goog-generation: 1702786810010326
content-type: text/javascript
x-goog-hash: crc32c=vixfVA==, md5=qpqDE1UtJzYkF83/bL1H9g==
cache-control: public, max-age=3600
x-goog-stored-content-length: 2652
accept-ranges: bytes
expires: Sun, 17 Dec 2023 05:21:28 GMT

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.css
anyfile-notepad.semaan.ca/assets/ 345 KB
345 KB 745ms
745ms Stylesheet
text/css 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.css
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 33793536c303f159d303681369bde4cbab1962beacc194b0c5fda6aa9d9fe20e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:29 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: text/css; charset=utf-8
access-control-allow-origin: *
accept-ranges: bytes
content-length: 353515

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ 4 KB
3 KB 75ms
34ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b32f5e6df197223f5ccba3786d782416b62d4d23600231122565e17f0487cb35

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:28 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 19:55:55 GMT
server: cloudflare
age: 1469
etag: W/"108c-60bf0db0ca069"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 836c6127fa9639fa-YYZ
expires: Sun, 17 Dec 2023 04:56:59 GMT

GET
H2 200 client.js Show response
apis.google.com/js/ 18 KB
8 KB 122ms
45ms Script
text/javascript 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/client.js?onload=gapi_loaded

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a379817563e29ccdddcdc630f00b7a519e9a8d2dda305e5a8b1b03715e4fc0bc

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 17 Dec 2023 04:21:29 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7115
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "35a725e7d2c1f214"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 04:21:29 GMT

GET
H2 200 client Show response
accounts.google.com/gsi/ 207 KB
80 KB 126ms
54ms Script
application/javascript 142.251.16.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/client

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f84.1e100.net

Software

ESF /

Resource Hash

5576ab0687d1ae4d6520da449a8db5fc4e4763d042b4c2a2722257cf0b66f388

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6SPRhKLmOEce6RuKRHAuHg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
content-security-policy: script-src 'report-sample' 'nonce-6SPRhKLmOEce6RuKRHAuHg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Sun, 17 Dec 2023 04:21:30 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 108ms
36ms Script
text/javascript 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f102.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 17 Dec 2023 04:05:16 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 974
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 17 Dec 2023 06:05:16 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/ 431 KB
135 KB 114ms
37ms Script
text/javascript 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

108cdb682e1d256ba58174d96775ec12fe2e9515ffa2ca7edfff49343a4d97ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sun, 17 Dec 2023 02:32:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6565
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138180
x-xss-protection: 0
server: cafe
etag: 6854214708762155125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 16 Dec 2024 02:32:05 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
227 B 43ms
42ms XHR
text/plain 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=319990985&t=pageview&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D&ul=en-us&de=UTF-8&dt=Anyfile%20Notepad&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1120428894&gjid=416424338&cid=51046481.1702786890&tid=UA-69003440-1&_gid=1953457719.1702786890&_r=1&_slc=1&z=1724087595

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f102.1e100.net

Software

Golfe2 /

Resource Hash

a59d6fec09f986c957c8192fbd71a84cc53315793fb9cde7de010e6a0cfccaea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 228 KB
81 KB 126ms
53ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

30d8898109b3bfe1ea41eec796d09afa0450b7237ba18eeb849bddcb0725e5c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82960
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 17 Dec 2023 04:21:30 GMT

POST
H2 200 / Show response
prebid.admedia.com/bidder/ 322 B
327 B 120ms
35ms XHR
application/json 173.198.200.125
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.admedia.com/bidder/
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.198.200.125 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: 173-198-200-125.static.as40244.net
Software: nginx /
Resource Hash: a1e50719a968ea53edbc079f52b7c11dd246df4313372fd7a584d50bc04a568c

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
content-encoding: gzip
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, private
access-control-allow-credentials: true
expires: 0

POST
H/1.1 200
OK prebid Show response
lockerdome.com/ladbid/ 11 B
345 B 211ms
52ms XHR
application/json 104.154.142.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/ladbid/prebid
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Date: Sun, 17 Dec 2023 04:21:30 GMT
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 31
Content-Type: application/json; charset=utf-8

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
203 B 104ms
35ms XHR
text/plain 198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.contextweb.com/header/ortb?src=prebid

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-expose-headers: Access-Control-Allow-Origin
strict-transport-security: max-age=15768000
access-control-allow-credentials: true
x-no-bid-reason: Passback by decision

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1895.006-3.034/ 187 KB
57 KB 35ms
35ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54eacec863498628814d62c486eca8cd1c580c77a4dda865b5941006e40c6e66

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 6766
etag: W/"2ede2-6099387db510d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 836c61317aba39fa-YYZ
expires: Tue, 16 Jan 2024 02:28:44 GMT

POST
H2 200 stats Show response
api.anyfile-notepad.semaan.ca/ 2 B
235 B 228ms
19ms XHR
text/plain 159.89.121.194
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://api.anyfile-notepad.semaan.ca/stats
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.121.194 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv.semaan.ca
Software: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: */*
Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 17 Dec 2023 04:21:30 GMT
server: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5
access-control-allow-headers: Content-Type, Authorization
content-length: 2
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/plain; charset=utf-8

GET
H2 200 Lato-Regular.ttf
anyfile-notepad.semaan.ca/fonts/ 593 KB
594 KB 267ms
266ms Font
font/ttf 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Lato-Regular.ttf
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 089ab6d4a57e0e6c4dd3b681b6fd50a5184f1b902429d35e1227e52d6ccad1bd

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/ttf
access-control-allow-origin: *
accept-ranges: bytes
content-length: 607720

GET
H2 200 Material-Design-Icons.woff
anyfile-notepad.semaan.ca/fonts/ 100 KB
100 KB 293ms
293ms Font
font/woff 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Material-Design-Icons.woff?3ocs8m
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: be00e19b662046cb8f2eb6eb86e4689edeefb0c003f6a215df9c22f0e15e16ad

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/woff
access-control-allow-origin: *
accept-ranges: bytes
content-length: 101968

GET
H2 200 logo.png
anyfile-notepad.semaan.ca/ 6 KB
6 KB 285ms
285ms Image
image/png 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://anyfile-notepad.semaan.ca/logo.png
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: bfb6a8799c9f3a60f0a04e2cc9c1d9df6c591708ae4aaa3eda711fcde2d31df9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
content-length: 6277

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/ 317 KB
109 KB 36ms
35ms Script
text/javascript 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c811d3b4bfb9a9a430211c1d03bd021a8779a08fb336d0045fe9a4c2397ad8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170508
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110664
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 22:37:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 04:59:42 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame 0D08 13 KB
3 KB 69ms
62ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 768df51615f83431607226a8910b2ba8287b755b272062c5de9c1afe281482e5

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 836c61324c2439fa-YYZ
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sun, 17 Dec 2023 04:21:30 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 283 B
349 B 53ms
50ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89d84e3f5757a91590fdcf25e70726c9d8a0850c2998a97c3bd247e7fbf13690

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript;charset=ISO-8859-1
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 836c61324c2739fa-YYZ

GET
H2 200 gsd Show response
router.infolinks.com/ 315 B
487 B 60ms
59ms Script
text/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D&jsv=1895.006-3.034&_cb=17027868905960
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 340a56a616f31408349a35c8e1b77495f80c9978a4ab9674cb1bde3e031d9bef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/javascript;charset=UTF-8
p3p: CP="NON DSP NID OUR COR"
cache-control: max-age=0
cf-ray: 836c61324c2839fa-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 44ms
43ms Ping
text/plain 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-3VRGCWTSLB&gtm=45je3bt0v9123192625&_p=1702786890403&gcd=11l1l1l1l2&dma=0&ul=en-us&sr=1600x1200&cid=51046481.1702786890&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D&dt=Anyfile%20Notepad&sid=1702786890&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=3817
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.16.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f102.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 proxy.html Show response
content.googleapis.com/static/ Frame 5339 382 B
908 B 42ms
37ms Document
text/html 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75e7d063e2c60402c27966468eb5104a486f32365454d0620c7adb71979570d7

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-6-DY_Cyk3EH02skhP90-KA' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 275
content-security-policy: script-src 'nonce-6-DY_Cyk3EH02skhP90-KA' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
content-type: text/html
cross-origin-embedder-policy: require-corp; report-to="apiserving"
cross-origin-opener-policy-report-only: same-origin; report-to="apiserving"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 04:21:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
pragma: no-cache
report-to: {"group":"apiserving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apiserving"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 891 B
853 B 457ms
457ms Fetch
text/plain 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2726990631903578&correlator=356839115743282&eid=31079960&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fif&iu_parts=61772569%2Cdbmtiqbxqoopp7t3s9lq_anyfilenotepadsemaanca_160x600_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702786890707&lmt=1690678352&adxs=1440&adys=65&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D&vis=1&psz=0x-1&msz=160x-1&fws=644&ohw=1600&ga_vid=51046481.1702786890&ga_sid=1702786891&ga_hid=319990985&ga_fc=true&dlt=1702786888401&idt=2011&adks=450036033&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7a2335a0b8d7673d2deea7d900cee7fb58917c02f30824e01e595a9b0864548

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:31 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 509
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
d12a1eed76f7baf6d1e310bb14a0c0b4.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3D76 6 KB
3 KB 138ms
44ms Document
text/html 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d12a1eed76f7baf6d1e310bb14a0c0b4.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 04:21:30 GMT
expires: Mon, 16 Dec 2024 04:21:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 88CC
Redirect Chain

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

1 KB
2 KB

32ms
31ms

Document
text/html

67.202.105.34
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.34 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip34.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 8f4c66e94763e1f7c15e8afe71863d253db7357f0b334b6a360428416e8ac6e9

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1403
content-type: text/html
date: Sun, 17 Dec 2023 04:21:29 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 0
date: Sun, 17 Dec 2023 04:21:30 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame DCEC
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

2 KB
971 B

49ms
48ms

Document
text/html

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1487925579e58de8d8b3c6a0973aa38c82e669d73aebc70515a74d71916d072

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 836c6133cc27a1ed-YYZ
content-encoding: br
content-type: text/html
date: Sun, 17 Dec 2023 04:21:30 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HMcqfjXK9ivKSR4o81THAYhDf20V05HEGPqWHwo7oA34FDF%2Ffv%2Bjlsx2PGiHjuw2dLlvVBbNrwgFTxyMcjGY0KY38eNpD4Vry%2BGBdwW1mfcpjyn0rsT%2BLhFQVztfQeKB8KgXVGz6kCT6TA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 836c61336b8fa1ed-YYZ
content-length: 0
date: Sun, 17 Dec 2023 04:21:30 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fb3%2FCVx2RHpt8VJlTUGyJTdr9Mz1n%2BNAlsh3zMjo%2B8ScUVwGKvphhW%2FnS%2FGwug1Dd36AYB3msVWjyxKeMsmezYCQNXkUEoY4J5usTu%2FFYsT5Fe8ne5qAAY5I0kRDQ6v3eGnziVCGFtbztg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6566 4 KB
2 KB 111ms
35ms Document
text/html 51.222.39.185
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.185 , Canada, ASN16276 (OVH, FR),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

e0cb0594967ab068862629c6c8fcbde5e716680adc6220e9f739e9eed4be02d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1513
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 0D08
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MTY5NkFCRkMtNEQxMy00OTRGLUJDQkEtQ0U5MTM2Q0UyMDJE&gdpr=-1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MTY5NkFCRkMtNEQxMy00OTRGLUJDQkEtQ0U5MTM2Q0UyMDJE&gdpr=-1&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=

0
74 B

6047ms
85ms

Image
text/html

104.36.113.107

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 104.36.113.107 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Sun, 17 Dec 2023 04:21:36 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

apn-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID
https://router.infolinks.com/dyn/apn-usync?user_id=2226258239364864504

35 B
213 B

52ms
52ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/apn-usync?user_id=2226258239364864504
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c61345fbe39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:30 GMT

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
an-x-request-uuid: d5ea827c-8dc6-46c0-8eb2-8d7325c6638b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://router.infolinks.com/dyn/apn-usync?user_id=2226258239364864504
x-proxy-origin: 86.48.15.79; 86.48.15.79; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sthr-us
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=k0cy4N0g
https://router.infolinks.com/dyn/sthr-us?user_id=85778e7a-33dc-4787-ac9f-1f72dc9dce32

35 B
199 B

70ms
68ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sthr-us?user_id=85778e7a-33dc-4787-ac9f-1f72dc9dce32
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6133fed639fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:30 GMT

Redirect headers

location: https://router.infolinks.com/dyn/sthr-us?user_id=85778e7a-33dc-4787-ac9f-1f72dc9dce32
date: Sun, 17 Dec 2023 04:21:30 GMT
content-length: 0

GET
H2

200

iqm-us
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://pxl.iqm.com/i/ck/infolink?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fiqm-us%3Fuid%3D%7BIQM_COOKIE%7D%20
https://router.infolinks.com/dyn/iqm-us?uid=3cc10a17-4f98-4519-8f97-80e704c25713

35 B
192 B

66ms
64ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/iqm-us?uid=3cc10a17-4f98-4519-8f97-80e704c25713
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6133fed339fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:30 GMT

Redirect headers

date: Sun, 17 Dec 2023 04:21:30 GMT
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/avif;charset=UTF-8
location: https://router.infolinks.com/dyn/iqm-us?uid=3cc10a17-4f98-4519-8f97-80e704c25713
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 81

GET
H2

200

eqv-us
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=112&gdpr=0&gdpr_consent=
https://router.infolinks.com/dyn/eqv-us?user_id=8315543112110228814&gdpr=0&gdpr_consent=

35 B
186 B

62ms
62ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/eqv-us?user_id=8315543112110228814&gdpr=0&gdpr_consent=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c613518bf39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

location: https://router.infolinks.com/dyn/eqv-us?user_id=8315543112110228814&gdpr=0&gdpr_consent=
date: Sun, 17 Dec 2023 04:21:30 GMT
content-length: 0

GET
H2 200 cm
u.openx.net/w/1.0/ Frame 0D08 43 B
295 B 112ms
69ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 0D08
Redirect Chain

https://ups.analytics.yahoo.com/ups/58786/sync?redir=true
https://ups.analytics.yahoo.com/ups/58786/sync?redir=true&verify=true
https://router.infolinks.com/dyn/VR-usync?uid=y-8A6wf9NE2uJC0M_xE36vkizqkgYaU3nV~A
https://pixel.tapad.com/idsync/ex/receive?partner_id=3399&partner_device_id=y-8A6wf9NE2uJC0M_xE36vkizqkgYaU3nV~A
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3399&partner_device_id=y-8A6wf9NE2uJC0M_xE36vkizqkgYaU3nV~A
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=ba147aac-a4a4-425d-8ff3-37300aed6885%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c550f4ca-ecd2-4be0-899e-54c85227a70a&ttd_puid=ba147aac-a4a4-425d-8ff3-37300aed6885%2C%2C

95 B
124 B

57ms
56ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c550f4ca-ecd2-4be0-899e-54c85227a70a&ttd_puid=ba147aac-a4a4-425d-8ff3-37300aed6885%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:34 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c550f4ca-ecd2-4be0-899e-54c85227a70a&ttd_puid=ba147aac-a4a4-425d-8ff3-37300aed6885%2C%2C
date: Sun, 17 Dec 2023 04:21:33 GMT
server: Kestrel
content-length: 359

GET
H2

200

r1-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://sync.1rx.io/usersync2/infolinks
https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1702786890822
https://ad.turn.com/r/cs?pid=45&rndcb=3551848386
https://sync.1rx.io/usersync/turn/2806190168601650691?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fr1-usync%3Fuid%3DRX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005
https://router.infolinks.com/dyn/r1-usync?uid=RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005

35 B
203 B

55ms
54ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/r1-usync?uid=RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:34 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6148e88939fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:34 GMT

Redirect headers

location: https://router.infolinks.com/dyn/r1-usync?uid=RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005
date: Sun, 17 Dec 2023 04:21:34 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXaf7d044afca044b1b560b0dfe5facaef005
content-type: text/html

GET
H2

200

zmn-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__&s=2
https://router.infolinks.com/dyn/zmn-usync?uid=xbAjFmCFpBjRq3xt_0nm

35 B
199 B

56ms
56ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zmn-usync?uid=xbAjFmCFpBjRq3xt_0nm
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c61343f5439fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:30 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:30 GMT
Content-Type: text/html; charset=utf-8
Location: https://router.infolinks.com/dyn/zmn-usync?uid=xbAjFmCFpBjRq3xt_0nm
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 90
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

tplift
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://router.infolinks.com/dyn/tplift?uid=1693720045507118238816

35 B
212 B

58ms
58ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/tplift?uid=1693720045507118238816
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c61343f5639fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:30 GMT

Redirect headers

location: https://router.infolinks.com/dyn/tplift?uid=1693720045507118238816
date: Sun, 17 Dec 2023 04:21:30 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sonobi-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
https://router.infolinks.com/dyn/sonobi-usync?uid=a89d7b68-d70a-43ae-90ff-1c11bbf311a4

35 B
248 B

55ms
55ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sonobi-usync?uid=a89d7b68-d70a-43ae-90ff-1c11bbf311a4
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6134a81a39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-189
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://router.infolinks.com/dyn/sonobi-usync?uid=a89d7b68-d70a-43ae-90ff-1c11bbf311a4
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

imd-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://ad.360yield.com/ul_cb/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://router.infolinks.com/dyn/imd-usync?user_id=366c694b-70c0-4f8a-bc47-eb893eca2dbf&partner_id=1531

35 B
226 B

58ms
57ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/imd-usync?user_id=366c694b-70c0-4f8a-bc47-eb893eca2dbf&partner_id=1531
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c613baab539fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:32 GMT

Redirect headers

location: https://router.infolinks.com/dyn/imd-usync?user_id=366c694b-70c0-4f8a-bc47-eb893eca2dbf&partner_id=1531
access-control-allow-origin: *
date: Sun, 17 Dec 2023 04:21:32 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

outh-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://router.infolinks.com/dyn/outh-usync?uid=y-FacuarJE2uEV3Z45lNm0W5YKRdsi_.4m~A

35 B
203 B

51ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/outh-usync?uid=y-FacuarJE2uEV3Z45lNm0W5YKRdsi_.4m~A
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6134e87c39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

location: https://router.infolinks.com/dyn/outh-usync?uid=y-FacuarJE2uEV3Z45lNm0W5YKRdsi_.4m~A
date: Sun, 17 Dec 2023 04:21:31 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET user-sync
sync.adkernel.com/ Frame 0D08 0
0

GET
H2

200

frwh-us
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3695&gdpr=&gdpr_consent=
https://router.infolinks.com/dyn/frwh-us?user_id=269a2f945d9bc6c25c73e5ec1dc953c&gdpr_consent=&gdpr=

35 B
196 B

61ms
60ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/frwh-us?user_id=269a2f945d9bc6c25c73e5ec1dc953c&gdpr_consent=&gdpr=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c61371bee39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:31 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://router.infolinks.com/dyn/frwh-us?user_id=269a2f945d9bc6c25c73e5ec1dc953c&gdpr_consent=&gdpr=
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1702786891327048-259

GET
H2

200

sovrn-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
https://router.infolinks.com/dyn/sovrn-usync?uid=H1ZFjLZHAPx2YoirT2-6ssQs

35 B
226 B

52ms
52ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sovrn-usync?uid=H1ZFjLZHAPx2YoirT2-6ssQs
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c61377c7039fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

Date: Sun, 17 Dec 2023 04:21:31 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://router.infolinks.com/dyn/sovrn-usync?uid=H1ZFjLZHAPx2YoirT2-6ssQs
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET

SPug
image4.pubmatic.com/AdServer/ Frame 0D08
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://image4.pubmatic.com/AdServer/SPug?p=60809&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fusersync%3Fpmuservalue%3D1696ABFC-4D13-494F-BCBA-CE9136CE202D

0
0

GET
H2

200

mnet-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://cs.media.net/cksync?cs=41&ovsid=setstatuscode&type=inf&redirect=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmnet-usync%3Fuid%3D%3Cvsid%3E
https://router.infolinks.com/dyn/mnet-usync?uid=3457884929022348000V10

35 B
190 B

51ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mnet-usync?uid=3457884929022348000V10
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c613c4bbc39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:32 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:32 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://router.infolinks.com/dyn/mnet-usync?uid=3457884929022348000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Sun, 17 Dec 2023 04:21:32 GMT

GET
H2

200

mgid-us
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://cm-x.mgid.com/5abf3d2eff2f70c0a0669cd9f0f84ba0.gif?puid=[UID]&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmgid-us%3Fuser_id%3D%5BUID%5D
https://router.infolinks.com/dyn/mgid-us?user_id=ed2497c5-c75f-4cd2-abbd-01a91f165ea4

35 B
200 B

52ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mgid-us?user_id=ed2497c5-c75f-4cd2-abbd-01a91f165ea4
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c613cac2139fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:32 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:32 GMT
Transfer-Encoding: chunked
Location: https://router.infolinks.com/dyn/mgid-us?user_id=ed2497c5-c75f-4cd2-abbd-01a91f165ea4
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=5
Expires: 0

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=infolinks
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6243758066
https://sync.1rx.io/usersync/tradedesk/c550f4ca-ecd2-4be0-899e-54c85227a70a
https://sync.targeting.unrulymedia.com/csync/RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005

35 B
204 B

53ms
52ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:34 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6148e88b39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:34 GMT

Redirect headers

location: https://router.infolinks.com/dyn/ur-usync?uid=RX-af7d044a-fca0-44b1-b560-b0dfe5facaef-005
date: Sun, 17 Dec 2023 04:21:34 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXaf7d044afca044b1b560b0dfe5facaef005
content-type: text/html

GET
H2

200

qc-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://cms.quantserve.com/pixel/p-u1vdacBMXAcfT.gif?idmatch=0
https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=0zR0ftI2d3nIOHoigTNuI4Q5IH_INHYpgzLRi9XL

35 B
205 B

57ms
57ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=0zR0ftI2d3nIOHoigTNuI4Q5IH_INHYpgzLRi9XL
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6138feb339fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=0zR0ftI2d3nIOHoigTNuI4Q5IH_INHYpgzLRi9XL
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

zeta-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://p.rfihub.com/cm?pub=43153&in=1
https://router.infolinks.com/dyn/zeta-usync?uid=1797288128888088381

35 B
186 B

60ms
59ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zeta-usync?uid=1797288128888088381
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6138de7b39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/zeta-usync?uid=1797288128888088381
Date: Sun, 17 Dec 2023 04:21:31 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

disus
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fdisus%3Fuid%3D%24UID&partner=infolinks
https://bh.contextweb.com/bh/rtset?pid=562894&ev=1&gdpr=&gdpr_consent=${GDPR_CONSENT}&us_privacy=&rurl=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D29%26buyeruid%3D%25%25VGUID%25%25%26r%3DCid1YS...
https://ssp.disqus.com/match?bidder=29&buyeruid=OHrDdDb03zKx&r=Cid1YS02NDllMzgyNi0zOGM5LTM4NTMtOWJlZS1jZTVhNDg2YzFkYWUQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW4vZGlzdXM_dWlkPXVhLT...
https://sync.go.sonobi.com/us?gdpr=&gdpr_consent=&us_privacy=&loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS02NDllMzgyNi0zOGM5LTM4NTMtOWJlZS1jZTVhNDg2YzF...
https://ssp.disqus.com/match?bidder=18&buyeruid=a89d7b68-d70a-43ae-90ff-1c11bbf311a4&r=Cid1YS02NDllMzgyNi0zOGM5LTM4NTMtOWJlZS1jZTVhNDg2YzFkYWUQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS...
https://router.infolinks.com/dyn/disus?uid=ua-649e3826-38c9-3853-9bee-ce5a486c1dae

35 B
278 B

51ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/disus?uid=ua-649e3826-38c9-3853-9bee-ce5a486c1dae
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c613b19e139fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:32 GMT

Redirect headers

location: https://router.infolinks.com/dyn/disus?uid=ua-649e3826-38c9-3853-9bee-ce5a486c1dae
pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

33a-usync
router.infolinks.com/dyn/ Frame 0D08
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
https://router.infolinks.com/dyn/33a-usync?uid=212383597752998

35 B
185 B

52ms
52ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/33a-usync?uid=212383597752998
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c61396f5839fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:31 GMT

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
referrer-policy: unsafe-url
server: 33XP017
x-33x-status: 100000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://router.infolinks.com/dyn/33a-usync?uid=212383597752998
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 0D08
Redirect Chain

https://router.infolinks.com/dyn/iq-usync
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=7df8a2e6-3fb4-4757-b0c5-79ee7d1087a9&3rddpi=2023874098&3rdpcid=ZX53SrhTHbsQbPuIplwC.AAA%261393&3rddpi...

43 B
955 B

47ms
46ms

Image
image/gif

13.224.214.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=7df8a2e6-3fb4-4757-b0c5-79ee7d1087a9&3rddpi=2023874098&3rdpcid=ZX53SrhTHbsQbPuIplwC.AAA%261393&3rddpi=1810047279&3rdpcid=3cc10a17-4f98-4519-8f97-80e704c25713&3rddpi=1639354730&3rdpcid=y-FacuarJE2uEV3Z45lNm0W5YKRdsi_.4m%7EA&3rddpi=445262707&3rdpcid=EWCeJ8zMsDLa4QZ2yL9hJ3-bGQ519y0nudaqaRlVW4Y&3rddpi=1634346717&3rdpcid=xbAjFmCFpBjRq3xt_0nm&3rddpi=1177082855&3rdpcid=1797288128888088381&3rddpi=1213503647&3rdpcid=y-8A6wf9NE2uJC0M_xE36vkizqkgYaU3nV%7EA&3rddpi=443164713&3rdpcid=0zR0ftI2d3nIOHoigTNuI4Q5IH_INHYpgzLRi9XL
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Server: 13.224.214.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-10.phl50.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 6ef53c06467f47a1223db91b4e03cb22.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-cache: Miss from cloudfront
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: TSnFndoD8qVIMGxOsVv6blBEyJmX1sZfrmM7YBtZP966t6ARQrNcvw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=7df8a2e6-3fb4-4757-b0c5-79ee7d1087a9&3rddpi=2023874098&3rdpcid=ZX53SrhTHbsQbPuIplwC.AAA%261393&3rddpi=1810047279&3rdpcid=3cc10a17-4f98-4519-8f97-80e704c25713&3rddpi=1639354730&3rdpcid=y-FacuarJE2uEV3Z45lNm0W5YKRdsi_.4m%7EA&3rddpi=445262707&3rdpcid=EWCeJ8zMsDLa4QZ2yL9hJ3-bGQ519y0nudaqaRlVW4Y&3rddpi=1634346717&3rdpcid=xbAjFmCFpBjRq3xt_0nm&3rddpi=1177082855&3rdpcid=1797288128888088381&3rddpi=1213503647&3rdpcid=y-8A6wf9NE2uJC0M_xE36vkizqkgYaU3nV%7EA&3rddpi=443164713&3rdpcid=0zR0ftI2d3nIOHoigTNuI4Q5IH_INHYpgzLRi9XL
cache-control: no-store
cf-ray: 836c61395f3e39fa-YYZ
content-length: 0

GET
H2 200 iqusync-1.26.min.js Show response
resources.infolinks.com/static/usync/ 2 KB
1 KB 36ms
35ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.26.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84f1c50bf0e9ba617aa63fe19f1a6026d6c424771fffcbfa3f9bb14ba95d59d9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 11:50:03 GMT
server: cloudflare
age: 7449
etag: W/"993-60b4922bbf851"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 836c61332dae39fa-YYZ
expires: Tue, 16 Jan 2024 02:17:21 GMT

POST
H2 204 apiserving
csp.withgoogle.com/csp/ Frame 5339 0
0 130ms
54ms Other
text/html 172.253.63.141
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.withgoogle.com/csp/apiserving
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.141 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f141.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://content.googleapis.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

GET
H3 200 googleapis.proxy.js Show response
apis.google.com/js/ Frame 5339 18 KB
7 KB 47ms
45ms Script
text/javascript 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/googleapis.proxy.js?onload=startup

Requested by

Host: content.googleapis.com
URL: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54f949b9360203008385fd828748b0fe2ac0b98d1912c8a00aa9aeec168a7fc8

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 17 Dec 2023 04:21:30 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7117
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "35658d020f18bac7"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 04:21:30 GMT

POST
H2 200 doq.htm Show response
rt3041.infolinks.com/action/ 2 KB
2 KB 147ms
106ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3041.infolinks.com/action/doq.htm?pcode=utf-8&r=17027868907511
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 264bc83da1a59d2c1e8e2276db0abdf674ad55bb8938f72dd9be60cf5c2868fd

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-language: en-CA
cf-ray: 836c61338b195407-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 iquid.js Show response
resources.infolinks.com/static/ 54 KB
13 KB 31ms
29ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/iquid.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.26.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c35a725ae1976af59c99556ad69e993dd9cf474033a75bb9406d59819d573d4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
server: cloudflare
age: 11586
etag: W/"d8c3-5f7533fc75a6e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 836c61336df439fa-YYZ
expires: Tue, 16 Jan 2024 01:08:24 GMT

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 10 KB
4 KB 72ms
25ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.26.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5194891d3a8501374db8afe22463ed2a49fa28f22eaa4a1991d2e6e8a15191e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:07 GMT
server: cloudflare
age: 415193
etag: W/"6540128b-2675"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 836c6133bce639cf-YYZ
expires: Wed, 20 Dec 2023 04:21:30 GMT

GET
H2 200 id5.js Show response
resources.infolinks.com/static/ 58 KB
17 KB 33ms
32ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/id5.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.26.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 26 Mar 2023 15:25:02 GMT
server: cloudflare
age: 11142
etag: W/"e65f-5f7cf3aed6f0f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 836c61336df539fa-YYZ
expires: Tue, 16 Jan 2024 01:15:48 GMT

GET
H2 200 ppid.js Show response
cdn-ima.33across.com/ 10 KB
4 KB 75ms
28ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ppid.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.26.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9470010730b754d8563690539a873235785bfd53e4af5cd93e0b08567d76c45e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:17 GMT
server: cloudflare
age: 241368
etag: W/"65401295-2847"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 836c6133bce739cf-YYZ
expires: Wed, 20 Dec 2023 04:21:30 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/ Frame 5339 78 KB
27 KB 37ms
36ms Script
text/javascript 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/googleapis.proxy.js?onload=startup

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

sffe /

Resource Hash

d52e7ae55aeb9f3fc1d1c1762a9c7d22f0e7ba0b453e6115a7fdb0d42f91bf70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 06:40:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164468
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27949
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 22:37:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 06:40:22 GMT

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 92 B
911 B 145ms
50ms XHR
text/html 18.238.4.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=328512134&pt=17&dpn=1&jsver=5.36&iiqidtype=2&iiqpcid=8ca8aaf6-0ff6-49e6-93d1-98c8e2b96766&iiqpciddate=1702786890814&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=928_1702786890815&fbp=1445990223&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/iquid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.4.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-4-65.phl51.r.cloudfront.net
Software: /
Resource Hash: 290e0b2a0facf520e51e57ad7f3a6f2f577206473aaa35ce9bd302d6a143fc4b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 a914ae2afc6a4cecb4160376b03ff6a2.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL51-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
pragma: no-cache
access-control-max-age: 3600
vary: Origin
content-type: text/html
access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-allow-methods: POST, GET
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: HglzZBeM1X8Az1hWY4julQu6eyY7awY1rXGZ84zjZesrGU7avnWCJw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/
Redirect Chain

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=91672&iiqidtype=2&iiqpcid=8ca8aaf6-0ff6-49e6-93d1-98c8e2b96766&iiqpciddate=1702786890814&tsrnd...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=91672&iiqidtype=2&iiqpcid=8ca8aaf6-0ff6-49e6-93d1-98c8e2b96766&iiqpciddate=1702786890814&tsrn...

43 B
937 B

72ms
53ms

Image
image/gif

13.224.214.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=91672&iiqidtype=2&iiqpcid=8ca8aaf6-0ff6-49e6-93d1-98c8e2b96766&iiqpciddate=1702786890814&tsrnd=789_1702786890815&fbp=1445990223&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=kdvcBQmKTa&nc=false&trid=-1662634741
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Server: 13.224.214.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-10.phl50.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
via: 1.1 6ef53c06467f47a1223db91b4e03cb22.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-cache: Miss from cloudfront
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: UUq3vstWZ3IpbGX--9hBlfpDzpLN7gUYSPiPDMKxpyRxtRbZ-wIRow==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 6ef53c06467f47a1223db91b4e03cb22.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=91672&iiqidtype=2&iiqpcid=8ca8aaf6-0ff6-49e6-93d1-98c8e2b96766&iiqpciddate=1702786890814&tsrnd=789_1702786890815&fbp=1445990223&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=kdvcBQmKTa&nc=false&trid=-1662634741
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: EBIV_qkZdZTW8N6yezl0SGFLtOgLlS5jNEd23BIZOM6XRR5Th5fv4Q==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
285 B 361ms
118ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

652f150699d809ddb45506e415806595d0e5553b90ae81378f24739c9782bad2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Sun, 17 Dec 2023 04:21:30 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2

200

/
onetag-sys.com/match/ Frame 6566
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=9d09657e-774a-4300-9108-18450cf77e29&gdpr=1&gdpr_consent=

0
340 B

35ms
35ms

Image
text/plain

51.222.39.185
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=9d09657e-774a-4300-9108-18450cf77e29&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.185 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Sun, 17 Dec 2023 04:21:30 GMT
Server: MT3 1237 600843f master ord ord-pixel-x19 config_version:"1642"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=9d09657e-774a-4300-9108-18450cf77e29&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 17 Dec 2023 04:21:29 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 6566 0
239 B 596ms
107ms Image
image/gif 213.19.162.90
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 213.19.162.90 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 17c962550296893d145ef1b8078fc6d6
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 6566
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fonetag-sys.com%252Fmatch%252F%253Fint_id%253D98%2526gdpr%253D1%2526gdpr_consent%253D%2526uid%253D%24UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=5885680601684488795

0
340 B

36ms
36ms

Image
text/plain

51.222.39.185
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=5885680601684488795

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.185 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
an-x-request-uuid: 07cd6eb3-8d3a-42c0-a6f5-b1466a7aaa80
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=5885680601684488795
x-proxy-origin: 86.48.15.79; 86.48.15.79; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 6566
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=3&uid=2ec1f933699ae26afb941236cd71227&gdpr_consent=&gdpr=1

0
340 B

35ms
34ms

Image
text/plain

51.222.39.185
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=3&uid=2ec1f933699ae26afb941236cd71227&gdpr_consent=&gdpr=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.185 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:31 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=3&uid=2ec1f933699ae26afb941236cd71227&gdpr_consent=&gdpr=1
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1702786891302008-1214

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 6566 42 B
927 B 160ms
36ms Image
image/gif 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=EWCeJ8zMsDLa4QZ2yL9hJ3-bGQ519y0nudaqaRlVW4Y
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 6566
Redirect Chain

https://cs.admanmedia.com/73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%2...
https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=8052e796-3601-49c5-88b3-5b4af3b7cfae

0
340 B

35ms
34ms

Image
text/plain

51.222.39.185
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=8052e796-3601-49c5-88b3-5b4af3b7cfae

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.185 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:30 GMT
Server: nginx
Location: https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=8052e796-3601-49c5-88b3-5b4af3b7cfae
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6566
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjHYB_Ic-xrkv38GdN8lOgkuRwTnHVWCWkA
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjHYB_Ic-xrkv38GdN8lOgkuRwTnHVWCWkA&google_tc=

170 B
188 B

48ms
48ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjHYB_Ic-xrkv38GdN8lOgkuRwTnHVWCWkA&google_tc=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjHYB_Ic-xrkv38GdN8lOgkuRwTnHVWCWkA&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 318
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ Frame 6566 0
44 B 358ms
34ms Image
text/plain 23.105.12.159
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.159 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 6566
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=EWCeJ8zMsDLa4QZ2yL9hJ3-bGQ519y0nudaqaRlVW4Y

43 B
479 B

3206ms
44ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=EWCeJ8zMsDLa4QZ2yL9hJ3-bGQ519y0nudaqaRlVW4Y

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:34 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: N4GK0BQCP8ZB8D5F95QB
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=EWCeJ8zMsDLa4QZ2yL9hJ3-bGQ519y0nudaqaRlVW4Y
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 6566 0
39 B 32ms
26ms Image
text/plain 162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:29 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 6566
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm=&google_tc=
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEP10tqi0hvihN2itXNcJgfA&google_cver=1

0
340 B

34ms
34ms

Image
text/plain

51.222.39.185
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEP10tqi0hvihN2itXNcJgfA&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.185 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ec2-3-225-218-10.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEP10tqi0hvihN2itXNcJgfA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame 6566 0
15 B 43ms
36ms Image
text/plain 3.225.218.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 6566
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=c550f4ca-ecd2-4be0-899e-54c85227a70a&gdpr=0&gdpr_consent=

0
340 B

35ms
35ms

Image
text/plain

51.222.39.185
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=c550f4ca-ecd2-4be0-899e-54c85227a70a&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.185 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=29&uid=c550f4ca-ecd2-4be0-899e-54c85227a70a&gdpr=0&gdpr_consent=
date: Sun, 17 Dec 2023 04:21:31 GMT
server: Kestrel
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 6566 43 B
235 B 138ms
45ms Image
image/gif 35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 04:21:30 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 onetag-usync
router.infolinks.com/dyn/ Frame 6566 35 B
262 B 54ms
50ms Image
image/gif 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/onetag-usync?uid=EWCeJ8zMsDLa4QZ2yL9hJ3-bGQ519y0nudaqaRlVW4Y
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6133fece39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:30 GMT

GET
H2

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0
https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0&b=1&g=FL30vexySqw36r4DW3v79sdyLhMOaTmAq6lIPAMngtk%3D

42 B
138 B

52ms
50ms

XHR
application/json

35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0&b=1&g=FL30vexySqw36r4DW3v79sdyLhMOaTmAq6lIPAMngtk%3D
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
referrer-policy: unsafe-url
vary: origin
access-control-allow-origin: https://anyfile-notepad.semaan.ca
location: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0&b=1&g=FL30vexySqw36r4DW3v79sdyLhMOaTmAq6lIPAMngtk%3D
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

ppid Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/ppid?pid=0015a0000344WLkAAM&ver=1.2.0
https://lexicon.33across.com/v1/ppid?pid=0015a0000344WLkAAM&ver=1.2.0&b=1&g=4Yn2ukgzsF9Ad6sglSHfMwHTGYnWVdufWRYdGxlQ01k%3D&fp=Vk4Z%2F3fzJnxVAWSaWa4KxgTHTlnxW5QXyXCuiue3Y1SQ5djKJpW2Zh80zFqs413ui5Zqx...

42 B
94 B

40ms
39ms

XHR
application/json

35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/ppid?pid=0015a0000344WLkAAM&ver=1.2.0&b=1&g=4Yn2ukgzsF9Ad6sglSHfMwHTGYnWVdufWRYdGxlQ01k%3D&fp=Vk4Z%2F3fzJnxVAWSaWa4KxgTHTlnxW5QXyXCuiue3Y1SQ5djKJpW2Zh80zFqs413ui5ZqxFr2KZrUf49FsZxvAQ%3D%3D
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
referrer-policy: unsafe-url
vary: origin
access-control-allow-origin: https://anyfile-notepad.semaan.ca
location: https://lexicon.33across.com/v1/ppid?pid=0015a0000344WLkAAM&ver=1.2.0&b=1&g=4Yn2ukgzsF9Ad6sglSHfMwHTGYnWVdufWRYdGxlQ01k%3D&fp=Vk4Z%2F3fzJnxVAWSaWa4KxgTHTlnxW5QXyXCuiue3Y1SQ5djKJpW2Zh80zFqs413ui5ZqxFr2KZrUf49FsZxvAQ%3D%3D
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 3E26
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
555 B

1114ms
28ms

Document
text/html

23.60.5.157
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.5.157 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-5-157.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Dec 2023 04:21:32 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 17 Dec 2023 04:21:30 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 1E08
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1702786890850.6&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26predire...
https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

16 KB
6 KB

3150ms
43ms

Document
text/html

23.195.100.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.195.100.214 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-100-214.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=32056
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Sun, 17 Dec 2023 04:21:34 GMT
expires: Sun, 17 Dec 2023 13:15:50 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Sun, 17 Dec 2023 04:21:30 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP006
x-33x-status: 40000000008200000C

GET
H2

200

match
events-ssc.33across.com/ Frame 88CC
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=the33across&bsw_user_id=20b8b566-fa11-46db-ae43-731595d0e7f3&gdpr=&gdpr_consent=&us_privacy=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=the33across&bsw_user_id=20b8b566-fa11-46db-ae43-731595d0e7f3&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=88eb6ee7-6c05-46cc-993c-1802fe1731af&ssp=the33across
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=20b8b566-fa11-46db-ae43-731595d0e7f3
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=20b8b566-fa11-46db-ae43-731595d0e7f3&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

79ms
41ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=20b8b566-fa11-46db-ae43-731595d0e7f3&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:31 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=20b8b566-fa11-46db-ae43-731595d0e7f3&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 88CC
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-.1zw3sFE2uEpH0_yY35QI0bOFmSzLAB6~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-.1zw3sFE2uEpH0_yY35QI0bOFmSzLAB6%7EA&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
216 B

173ms
40ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-.1zw3sFE2uEpH0_yY35QI0bOFmSzLAB6%7EA&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:31 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
referrer-policy: unsafe-url
server: 33XP010
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-.1zw3sFE2uEpH0_yY35QI0bOFmSzLAB6%7EA&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET current
33across-match.dotomi.com/match/bounce/ Frame 88CC 0
0

GET
H2

200

match
events-ssc.33across.com/ Frame 88CC
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID
https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=1693720045507118238816
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1693720045507118238816&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

185ms
41ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1693720045507118238816&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:31 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
referrer-policy: unsafe-url
server: 33XP014
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1693720045507118238816&ts=1702786891&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DCEC
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c550f4ca-ecd2-4be0-899e-54c85227a70a&expiration=1705378890&gdpr=0&gdpr_consent=

43 B
739 B

48ms
47ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c550f4ca-ecd2-4be0-899e-54c85227a70a&expiration=1705378890&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oajmgrrn8%2FYQ7RUuDMpzEqL2ZObOECMbSLOhzYnElPsgFKOTy%2BSaV4G8BWaMfKUodwiSddEiKMW%2Fmg%2Fp%2BFYP4FIX1mZWubMq2miKkEMt6cnMq%2FyjkJ2c3t4u%2Fd8z%2Bv0ulFhW9az4UkuqVg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836c6134ee1936fb-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c550f4ca-ecd2-4be0-899e-54c85227a70a&expiration=1705378890&gdpr=0&gdpr_consent=
date: Sun, 17 Dec 2023 04:21:31 GMT
server: Kestrel
content-length: 323

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame DCEC
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX53SrhTHbsQbPuIplwC-AAABXEAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX53SrhTHbsQbPuIplwC-AAABXEAAAAB&gpp=&gpp_sid=&dcc=t

43 B
855 B

148ms
60ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX53SrhTHbsQbPuIplwC-AAABXEAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:34 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 8QBHZAXWB8564PN2WC9T
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:34 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ASHWEMTC0N5WJY5P48B3
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX53SrhTHbsQbPuIplwC-AAABXEAAAAB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame DCEC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZX53SrhTHbsQbPuIplwC.AAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEC94QGab0sNxTARTHVQgCn0&google_cver=1&google_hm=2

43 B
735 B

46ms
46ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEC94QGab0sNxTARTHVQgCn0&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xdajQryotUF0t2s%2FAjD3J6PVPbaYFGoHNvC0NhWf8yctFZp%2BFLmdsAIlxsbnoOJVlTy5gFKjS9zg74vHdxxh9EcdGHthz%2Bnh%2FuZFdPnFGYgl20YjGWlKkWptDvVbBFHGfxeqyWSjB%2F6g1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836c6134ddd836fb-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEC94QGab0sNxTARTHVQgCn0&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame DCEC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZX53SrhTHbsQbPuIplwC-AAABXEAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=ZX53SrhTHbsQbPuIplwC-AAABXEAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=&google_tc=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENv3gpqlbYp0Jim2ak1FjcM&google_cver=1

43 B
773 B

43ms
42ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENv3gpqlbYp0Jim2ak1FjcM&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xqx4CADcvxsjycZkST%2FjkldGagNkq1a%2B7Xy%2FMypAJB0FCBvG2d2KVNR%2BNmKyAzALAqEF9qWrnUH5s45YH7pbDtuLESMIWXsa8sD7pIl0gi1CZNmCX1jsrhEIo%2BeS28Lnrpu66TWsF%2FX6gA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836c6134bdb336fb-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENv3gpqlbYp0Jim2ak1FjcM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET cookiesync
bttrack.com/pixel/ Frame DCEC 0
0

GET /
csync.loopme.me/ Frame DCEC 0
0

GET tp_out
d.adroll.com/cm/index/ Frame DCEC 0
0

GET current
casale-match.dotomi.com/match/bounce/ Frame DCEC 0
0

GET
H2 200 ix-usync
router.infolinks.com/dyn/ Frame DCEC 35 B
204 B 67ms
67ms Image
image/gif 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ix-usync?uid=ZX53SrhTHbsQbPuIplwC.AAA%261393
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c61342f3839fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:30 GMT

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/oauth2/v2/ Frame 5339 6 KB
2 KB 37ms
36ms XHR
application/json 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/oauth2/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a1d6b68a866302b8ea5ab414b02d7a847b9d9336c4a7485d395041c5e916e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.109%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.109%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Sun, 17 Dec 2023 04:02:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1139
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="federated-signon-mpm-access"
vary: Accept-Encoding
report-to: {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]}
content-type: application/json; charset=UTF-8
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Sun, 17 Dec 2023 04:52:31 GMT

GET
H2 200 in_search.js Show response
resources.infolinks.com/js/1895.006-3.034/ 225 KB
89 KB 34ms
34ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/in_search.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d1b618b508d6e2c3ab4c4d98feeddfdb66e6d87d9dcfd88097f1d85480c3af0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 13173
etag: W/"38471-6099387db3d85"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 836c61343f6039fa-YYZ
expires: Tue, 16 Jan 2024 00:41:56 GMT

GET ima3.js
imasdk.googleapis.com/js/sdkloader/ 0
0

GET
H2 200 container-3.0.html Show response
resources.infolinks.com/static/ Frame 3B48 1 KB
677 B 42ms
41ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/container-3.0.html
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71cb550e3eed0fa766ffd5596c6d7fd0460a06fca3483d762d0b0fd36731a100

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 5703
cache-control: max-age=2592000
cf-cache-status: HIT
cf-ray: 836c61344f8839fa-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 17 Dec 2023 04:21:30 GMT
expires: Tue, 16 Jan 2024 02:46:27 GMT
last-modified: Thu, 02 Nov 2023 07:15:03 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/drive/v2/ Frame 5339 96 KB
11 KB 52ms
51ms XHR
application/json 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/drive/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

79bc926799f18a6e36a83a2d2f4bcefc8ad3bdcc2fef86b2635238e993037fb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.109%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.109%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Sun, 17 Dec 2023 04:21:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10931
x-xss-protection: 0

GET
H2 200 getads.htm Show response
rt3041.infolinks.com/action/ 8 KB
6 KB 495ms
494ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3041.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22article%22%2C%22scs%22%3A%22k78PwYnVLF%22%7D%5D&rid=8e07bf22-e20d-4b85-a9b8-83b66bbc994a&jsv=1895.006-3.034&sr=1600X1200&rts=1702786890967&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=120.0.6099.109&dv=p&ce=t&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D&tzo=-0800&c=c&strg=true&pitc=50~5rb_yoaXVBsVhxMpVXcotq6jiVFvzGyP&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=nQKmiSeWbw3p9o_3-ccL9IEignk_oPfTbuppqZyv_dE3ZYOl39Lkr6SnXcrkGsKsnPKPEoTktm3Wz83AaHHoU7LivZlfmBIYsXP1n1xxLIf3agNSZD1yiAyl3VJzU2Ff46h-apkfdx523fe_uWYtIs92S1wi--GT&rsk=65&rcs=Q9WjYjfchGh5OvPKx_PXIw&cuid=7df8a2e6-3fb4-4757-b0c5-79ee7d1087a9&_pubcid=9fd18266-0225-4dc5-bc50-1ed2829ddd5b&hbnr=false
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d30a53b44ab7b4bacd456f965ba8a7a7c5e70fc850bb2ddbfaa5ee69b6ec1e3c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: en-CA
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 836c6134980839fa-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET sync
tracker.exchange.amitydigital.io/ Frame 3B48 0
0

GET
H2

200

ta-usync
router.infolinks.com/dyn/ Frame 3B48
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_device_id=7df8a2e6-3fb4-4757-b0c5-79ee7d1087a9=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7BTA_DE...
https://pixel.tapad.com/idsync/ex/receive/check?partner_device_id=7df8a2e6-3fb4-4757-b0c5-79ee7d1087a9=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=a936ce90-d728-4d71-95fb-9debb7a3beb6%252Chttps%25253A%25252F%25252Frouter.infolinks.com%25252Fdyn%25252Fta-usync%25253Fui...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c550f4ca-ecd2-4be0-899e-54c85227a70a&ttd_puid=a936ce90-d728-4d71-95fb-9debb7a3beb6%2Chttps%253A%252F%252Frouter.infolinks...
https://router.infolinks.com/dyn/ta-usync?uid=a936ce90-d728-4d71-95fb-9debb7a3beb6

35 B
245 B

56ms
56ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ta-usync?uid=a936ce90-d728-4d71-95fb-9debb7a3beb6
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state\={%22ids%22:[%221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%22],%22action%22:%22open%22,%22resourceKeys%22:{}}
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:34 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 836c6147ff1c39fa-YYZ
content-length: 35
expires: Sat, 17 Dec 2022 04:21:34 GMT

Redirect headers

date: Sun, 17 Dec 2023 04:21:34 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://router.infolinks.com/dyn/ta-usync?uid=a936ce90-d728-4d71-95fb-9debb7a3beb6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET user-sync
sync.adkernel.com/ Frame 3B48 0
0

GET usersync
e.serverbid.com/ Frame 3B48 0
0

GET
H3 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/ 89 KB
29 KB 36ms
36ms Script
text/javascript 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_1?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

sffe /

Resource Hash

0315897673f16bd0fad932cc9b0c68ff76da8abd1643561faf6c7e5ffbef0141

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 05:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170461
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29290
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 22:37:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 05:00:30 GMT

GET
H3 401 userinfo Show response
content.googleapis.com/oauth2/v2/ Frame 5339 304 B
251 B 146ms
145ms XHR
application/json 142.250.31.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/oauth2/v2/userinfo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.95 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f95.1e100.net

Software

ESF /

Resource Hash

a9ec945a24875fc594683ac8c3e176f2c199ed1011c8e1eec897d66c392d17b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.109%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.109%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 228
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 535.json Show response
id5-sync.com/g/v2/ 630 B
1 KB 3660ms
134ms XHR
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/535.json

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

27b3742576aa2fa69f72749bf19324a9b2dd7d147e294588271c7bb89d5e7c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Sun, 17 Dec 2023 04:21:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 adview.htm Show response
rt3041.infolinks.com/action/ 0
167 B 98ms
98ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3041.infolinks.com/action/adview.htm?rid=8e07bf22-e20d-4b85-a9b8-83b66bbc994a&bdc=1&midx=0&emd=NzE1fjM5NDFfNzcyMjE3OTN-NzcyMjE3OTM&rts=1702786891466&prod_t=d&jsv=1895.006-3.034&skin=sidebar&theme=nologo&sdata=article&scs=k78PwYnVLF&rsd=nQKmiSeWbw3p9o_3-ccL9IEignk_oPfTbuppqZyv_dE3ZYOl39Lkr6SnXcrkGsKsnPKPEoTktm3Wz83AaHHoU7LivZlfmBIYsXP1n1xxLIf3agNSZD1yiAyl3VJzU2Ff46h-apkfdx523fe_uWYtIs92S1wi--GT&rsk=65&rcs=Q9WjYjfchGh5OvPKx_PXIw
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
cf-ray: 836c6137b8d75407-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ab Show response
lax1-ib.adnxs.com/ Frame 1B54 19 KB
9 KB 266ms
90ms Script
application/javascript 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKTNvBMExsAAAMA1gAFAQjL7vmrBhDB09XNnarH3FgY1IPc1aLh3f9uKjYJqMMKt3wkJ0AR6L9iaNCrI0AZAAAAIIXrOkAh6L9iaNCrI0ApqMMJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQEG9I4BmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiQ3ZGY4YTJlNi0zZmI0LTQ3NTctYjBjNS03OWVlN2QxMDg3YTnYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTUwMTc5MzI5OfICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO2Z1bmN0aW9uIGwoYSl7bFsiICJdKGEpO3JldHVybiBhfWxbIiAiXT1mdW5jdGlvbigpe307AUZkbT1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj8VKyxhLGMpe3JldHVybiBaLQAQLmNhbGwBKSQsdm9pZCAwKX06Nj8ANGlmKCJzdHJpbmciPT09AWgQb2YgYSkJVhEaACEVGkhjfHwxIT1jLmxlbmd0aD8tMTphEZgkKGMsMCk7Zm9yKAG_GGU9MDtlPGENKVw7ZSsrKWlmKGUgaW4gYSYmYVtlXT09PWMNaAwgZTtyBccMLTF9OxGgHCBuKGEpe2E9Cbk4PT09YT9kb2N1bWVudDphDTAsIGEuY3JlYXRlRWxlARkYKCJpbWciKR1FAHAF_QhlKXsBlRRiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlwQpOwHjCWsEZj0RyAQoKSFlDRcEZz1aUwA8LGg9bShnLGQpOzA8PWgmJj7QARRzcGxpY2Upz3RnLGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqADBiJiYoZC5hdHRyaWJ1YbMUU3JjPSIiAb4Qc3JjPWNetwEkLnB1c2goZCl9CllLBHEoKZYEYT0xrDQuY3VycmVudFNjcmlwdE1PACgybgIsbnVsbDphKSYmIjc3YR0UYS5nZXRBDZA4ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RTfwTHI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0gV0AdBXgAGsFYQxjPVtdBQkEZT0Bxgw7ZG97Qa8YYj1hO3RyeQUMAGRBrRhkPSEhYiYmASQcIT1iLmxvY2EhaiAuaHJlZiliOnsBLZBsKGIuZm9vKTtkPSEwO2JyZWFrIGJ9Y2F0Y2goaCl7fWQ9ITF9AV4IZj1kGRcAZgEWDGlmKGYpeQBnPl4ADDtlPWJ1OQQmJhkMKC5yZWZlcnJlcnx8AZckfWVsc2UgZz1lLA3LAGMp4DBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9MfX13aGlsZShhJiZiIT1hKTtiPTCFqQBhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwArQwAPR11ACmhLxRhPTE7YTyxVEw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEcMDw9ZTstLWWhrEhmPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRR0KCksYz3Z3jwiPyIpO3NldFRpbWVvdXQoEYwNMQBl2VYYZT8uMDE6ZUE1RCEoTWF0aC5yYW5kb20oKT5lKWkPDGI9cSghpAAiZf80Oi8vIisoYiYmInRydWWBawBiVmsEOC1yY2QiKT8icGFnZWFkMs23EHN5bmRpabkgLWNuLmNvbSI6ZiMABSAMKSsiLwlFeC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSKFRQxkPShkAbEAKaG2UgQFAC0NMTAiKXx8InVua25vd24iYeNcK2QrIiZzYW1wbGU9IitlO2I9d2luZG93BVgAZjk0AGbhigBmITM0ZD1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSZsgZCkmJiEvRWRnGREcPyEwOiExO2RhkxVRMC5zZW5kQmVhY29uPwodaR0YIChlKTpwKGIsZRozCQQ9PQ2eCCl9fQ7iCBaqCCggMDw9Yz9hLnN1YhY_CRwoMCxjKTphfQngDC5yZmwuAggNNWhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJ5SmVUZVZpckM4Y1JlWHBIM3VZOWQwbjg3QXEyTy1TcWJpZGtVWjluQjJFdXItaHQzRGxFVjBMaHBna2dNTW5FRGtvR3NJZnN5Wm9fRzNCUmxJSThPSFB1WktwaE5STWJTdGVJemY2SHBZcnZMMTA0IiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL3xkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfUxovDAiJATwpfzYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUJSwA-DVMAPp05HCB7cjNweCgnJrsMHCcpO30pKCk7XQAQ_RQKEEgBnjRQT1JUX1BBUkFNUxLoFJE5ipUA8IZhZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTg2LjQ4LjE1Ljc5Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9JqiBfc3RhcnQ9MSallQRueVYhDhAmc3ViXw2TAGJBr_B9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1EclU1Z0FWa2lFQlBuUTBBY1NETkFFTGxEUUJFcFEwQVlLVk5BRjBsalFCZHBZMEFhMldOQUhtbGpRQjY1WTBBZi1YTkFFRG1EUUJDWmcwQVNTWU5BRTNtRFFCUTVnMEFaU1lOQUdqARAscFpnMEFiU1lOQUc0ARAsNDVnMEFlZVlOQUgwARBYOXBnMEFRNlpOQUVUbVRRQkZwazBBUnkBEAByARAUU1prMEFVARAERk8BEABVARAYV0daTkFGbwEQ9MMIUzNOQkFWTnpRUUZZYzBFQlF4MWNBb0VmWEFMX19ZZ0NKMEtxQWloQ3FnTC1lS29DUm9tcUFvQ2JxZ0tCbTZvQ2dwdXFBcUtvcWdMbHJLb0NmODJxQW5YYXFnSlYtS29DRFBxcUFpYjdxZ0pCLTZvQ0F4U3JBdU1mcXdKVUlLc0NYU0dyQWp3anF3S0VKNnNDVkNpckFqWXJxd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQXIwLXF3SkVRYXNDcmtHckFteEtxd0pnVHFzQ3VFNnJBaDFRcXdJZlVLc0M5RkNyQWdKUnF3SUtVYXNDSUZ5ckFzTm5xd0lfYXFzQ0dYR3JBdkJ4cXdKX2M2c0N5blNyQWhkM3F3SWJkNnNDSUhlckFpVjNxd0lxZDZzQ3MzaXJBZ2g1cXdLeWZxc0NVb0NyQWtxQnF3S2NnYXNDb1lHckFzcUNxd0xEaEtzQ1ZvZXJBbktIcXdLZmlxc0NfSXVyQWhTTXF3S3hqS3NDdEl5ckFpV1Fxd0pja3FzQ3FKZXJBbDZhcXdKeG42c0N1Wi1yQW15aHF3S3pvcXNDbHFTckFzbWtxd0tjcHFzQ0Y2cXJBdHVycXdLa3JLc0NRcTZyQWp1dnF3THhyNnNDeDdDckFzZXhxd0pBc3FzQ1NMS3JBbUt5cXdJUHM2c0NYN09yQXUyenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBb3kycXdMTHRxc0M2N2FyQWo2M3F3SlB0NnNDWHJlckFvMjNxd0sxdDZzQzByZXJBdDIzcXdJVHVLc0M1TGlyQWlHNXF3TDV1YXNDSnJxckFqVzZxd0o3dXFzQ3VMcXJBbGk3cXdJZ3ZLc0NUcnlyQXVXOHF3TEl2YXNDbE8wRkE1cDBKQVRBZFNRRUJWNzNCRUZlOXdUWWQ2NEZsWGl1QlE5NnJnVm5lNjRGbVh1dUJRZDhyZ1ZGdE1VRjBZWWpDbG0xLXhMOHhfc1NaUTc4RWo0Vl9CSnJGZndTOUJmOEVua1lfQkxuSGZ3UzZSMzhFdkFkX0JJU0h2d1NMQjc4RXFBZV9CTFpIdndTWVJfOEVzOGZfQkpibi1vVS1GWnJHckh3V1NoaGllRlomZXhrPTE1MDE3OTMyOTkmYXdiaWRfYz1BS0FtZi1DSWNaSEo0elNYdGE4VkIyZVpYMWFVUXRGZXFzRWZrTWJ3MGpwcjcteGFrRk1JQUhidzh6My1OT1g1YzhBYUp2U2k4SFpReHF3N2dWNU4xTDZSbHBXbVdZYlJkQ2lyVk4zTDBTQjBPYTRObWRad1ZBbWVEdDhXbkZ6c29helU5eGdSVVFjOEtZdm1Ga0MwR2R3bVpVYzlPdWstb2lBSDFJU01ELTliREJadXFFMWZ2OFJaY2VTMkJXcE8tTW5PTGVpeUx2a0omYXdiaWRfZD1BS0FtZi1EMFQ0RUFtZXJIR0lSR3pqbW9kUThkZU5mU05BSHQzbWVPdjZGdk9Ld0hBQnlWM3JkNmZXU3dDNzJEaUZYVm1MMHp3OGdSa0ZzMHBiTXhWZndqMlhOVnpialVJNnRlU09ZNlNEbThyRDFPQm9wZzV3NUNRYWlTS3hfNzh3bHdMV1ZsMEF3dW04eVRta2prQ2czTHQxaXF6MG9uejV2Szg4bEVqNnhPeU5nOHVhcFBra1M3OUtwUHlLdDIzcmNfTFJZcEdXa3Jna1loUzlZenJXdlR4WnpMcEtya1NYYnJmc3BDYjBIbzJxQ0JyeEZwUW00eXlsZy1ManlaY2xEWXJTbFp3dW5KSFlDOGJibi1RWlNtU0Vvd1N0WEVOa0ZhbGkwUVk3bm1PSTlZVmtNTE1oUjVDcU4zSzY2QVBkanJvampJb245Z25sczBGbTBZcTFIRHpfTjU2Tmp3MlJEcWFPcFpERGhCRVM1cndCVlpwTmVacGZDY3gwX1p0STUtUmpuTnVyblU0TnA0WUZlXzQyazNPeXBSTnZIbUFMU2otV3RHRENEc3R5dnN3anQzdU8zVXZ0TlpVYUJyeVA2aW1oTFBlbWNMamsyWWZJT0tPNXQxZ3cyTU5HTDY0aGxkSkthYXAtbmFaY1dmbXFJZkZCS1RLSzJXOXRDNkFNZnVMSXNwdVJEMnpvWVV0QTJUblp1WHJqcnBjUzdvQnJ4Tm1yMmhQQWdmNzFYR1BuRnl2bG5fOXQ5OGU1VDQ0MVJCa2R4WElqX0NueEhPX1MtUEk2Vm9ybXdtdDFReVZxR0hzRjlqeTRQeUs5VktldkExYVV5Y2wxMUdDR3NGYi1iWG1fV29nMzVMUmM1SE5tWTZZWlhLQkNEVDFjTE52WTRkeUJET3c3QWd1bTNpRllOeVFoZzJmWFNJTVNxWC0wRzZzUHZOMHNXTUhQQXJkTEx6OUtKWklTeExtLU8wTTQxU19nYUdBZHVoS0dLTEhwUmtKM2hvQVdUb1ZEdklQMXVwaUJSOGYxRkNRNUpjZG9IVEVTUkdxMzVUVGpUc2xEV0VDSENjU2d5Vkl2MHNybFE3Uk1rMV9xYXhlNFhXWW52OXhiR2toYXRHNTBZXzJMTjl4YXpyV25JUXBEcmNGbV9taHg5enVZSFFaMzEtUHpxSEp3aE43TDEzN1QtQzlUVERwb255NzVWdEhjWFU0dG02MnYzQVY3VFVnVTZuQWdIVWt2X0FhTFhZRlZkZzZTN01fS1lyb213c0hXdEtPVFdiMS1PeklKUHRxLVhXcVY1SG16YWdSeGYyY056X1ZzYm5kNzZLZDdfc19ob3RkbjMtSnEwVDN4akZOVTJQU0dvVFN3MzBjSDRtdS1kSkQtMU50b3UzT0E4T1VVMWMwdyZjaWQ9Q0FRU0d3QXZIaGZfMjFKdVZDeXloaDR5MVU1TWlxRk1QMkFndzZaOGdSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP8AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzJokOqjAM8NdEUkU1dEdzaGI3N1RCa2c5V3FRWW84OGxRMUZZTzIxbzJvQXp5c1RrWkNlNkZxak9zR1lrVGUwMmNEeS00bHliakJIVnJPYWp6S1hWWFp4UHBsOURSckdIM291MENIa1BXdlRmTVdmcDhDTUFma2RhbyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM2MzkzMTczMzgzNDExMjMxMTY5Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBAs4Ni4eGwvwbagEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8AShn-kkiAUBmAUAoAWf3bOe_4GEkEWqBSo4ZTA3YmYyMi1lMjBkLTRiODUtYTliOC04M2I2NmJiYzk5NGF-NzE1fjHABQDJBQAADgAaFPA_0gUJCQEKAQE02AUB4AUB8AXSlVb6BQQBiCiQBgCYBgC4BgDBBgEhNAAA8D_QBu6PAdoGFgoQCRIZAQG3oOAGAfIGAggAgAcBiAcAoAcBqgcMMTU4MjEyOTU5MzI5yAfs4gXSBw0JETcBNQjaBwYBbbAYAOAHAOoHAggA8AfnsQmKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=bad850e4eeaf3a009ad1af1bd0e650857d360eb9&pp=9.835574

Requested by

Host: blank
URL: about:blank

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

fc2a068cec2734c130319b1ef22a1469a3e5e3b591f52d2b7149b529b6df8afe

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:31 GMT
content-encoding: gzip
x-creative-id: 77221793
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-proxy-origin: 86.48.15.79; 86.48.15.79; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0
pragma: no-cache
an-x-request-uuid: e7babde6-1687-4a91-bf24-8d398b7b5355
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 if Show response
lax1-ib.adnxs.com/ Frame 8252 9 KB
6 KB 95ms
95ms Document
text/html 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKTNvQnBBMbAAADANYABQEIy-75qwYQwdPVzZ2qx9xYGNSD3NWi4d3_bio2CS9xQKd8JCdAEZvG9lrQqyNAGQAAACCF6zpAIei_YmjQqyNAKajDCrd8JCdAMQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJDdkZjhhMmU2LTNmYjQtNDc1Ny1iMGM1LTc5ZWU3ZDEwODdhOdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIYCgpJRlJBTUVfS0VZEgoxNTAxNzkzMjk58gLIFQoLUFJFX1NDUklQVFMSuBU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBrPXRoaXN8fHNlbGY7ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTt2YXIgbT1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbihhKXthPXZvaWQgMD09PWE_ZG9jdW1lbnQ6YTtyZXR1cm4gYS5jcmVhdGVFbGVtZW50KCJpbWciKX07ZnVuY3Rpb24gcChhLGMsZSl7dmFyIGI9ITE7Yj12b2lkIDA9PT1iPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSk7dmFyIGQ9bihhLmRvY3VtZW50KTtpZihlKXt2YXIgZj1mdW5jdGlvbigpe2lmKGUpe3ZhciBnPWEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzLGg9bShnLGQpOzA8PWgmJkFycmF5LnByb3RvIXuoLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAWGImJihkLmF0dHJpYnV0aW9uU3JjPSIiAb4kc3JjPWM7YS5nb0q3ASwucHVzaChkKX0KO2Zt7RAgcSgpe2GbXGE9ZG9jdW1lbnQuY3VycmVudFNjcmlwdE1PDChhPXZlJ0Q9PT1hP251bGw6YSkmJiI3NyIBEhAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQQXScpfTsBh_BScj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgR4ABrBWEMYz1bXQUJBGU9AcYIO2RvBf8YYj1hO3RyeQUMLGQ7aWYoZD0hIWImJgEkHCE9Yi5sb2NhIWogLmhyZWYpYjp7AS2QbChiLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKGgpe31kPSExfQHWCGY9ZBkXAGYBFgxpZihmCZkAZz5eAAw7ZT1idTkEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZSwNywBjKeAwbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_8EB9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlbmd0aC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9ayErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaxmrIdVl_wBnJRYlAgRlPTIEASAwPD1lOy0tZSkhukQ9Y1tlXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfXXQMHYoYSxjKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQoAfZkpAHeVKRh0KCksYz1h8UlAKCI_Iik7c2V0VGltZW91dCgRjA0xAGWZOhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyrQAQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQUZj8hMTpmITM0ZD1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSZsgZCkmJiEvRWRnGREcPyEwOiExO2RhkxVRMC5zZW5kQmVhY29uPwodaR0YJChlKTpwKGIsZSzVDAmeECl9fSwwVaBcMDw9Yz9hLnN1YnN0cmluZygwLGMpOmF9CeAQLnJmbD1dIwhyZXQOpgloZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CeUplVGVWaXJDOGNSZVhwSDN1WTlkMG44N0FxMk8tU3FiaWRrVVo5bkIyRXVyLWh0M0RsRVYwTGhwZ2tnTU1uRURrb0dzSWZzeVpvX0czQlJsSUk4T0hQdVpLcGhOUk1iU3RlSXpmNkhwWXJ2TDEwNCIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS-oZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1NDUklQVFMSiQE8cyV_Nh0BFm4IUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEbPHhiZmVfYmFja2ZpbGwuanMBZS3KDVMAPp05NCB7cjNweCgnMTUwMTc5DrsMHCcpO30pKCk7XQAQ_RQKEEgBnjRQT1JUX1BBUkFNUxLoFJE5ipUA8IZhZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTg2LjQ4LjE1Ljc5Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9JqiBfc3RhcnQ9MSallQxueWZpTiEOECZzdWJfDZMAYkGv8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TURyVTVnQVZraUVCUG5RMEFjU0ROQUVMbERRQkVwUTBBWUtWTkFGMGxqUUJkcFkwQWEyV05BSG1salFCNjVZMEFmLVhOQUVEbURRQkNaZzBBU1NZTkFFM21EUUJRNWcwQVpTWU5BR2oBECxwWmcwQWJTWU5BRzQBECw0NWcwQWVlWU5BSDABEFg5cGcwQVE2Wk5BRVRtVFFCRnBrMEFSeQEQAHIBEBRTWmswQVUBEARGTwEQAFUBEBhXR1pOQUZvARD0VQNTM05CQVZOelFRRlljMEVCUXgxY0FvRWZYQUxfX1lnQ0owS3FBaWhDcWdMLWVLb0NSb21xQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQ2Y4MnFBblhhcWdKVi1Lb0NEUHFxQWliN3FnSkItNm9DQXhTckF1TWZxd0pVSUtzQ1hTR3JBandqcXdLRUo2c0NWQ2lyQWpZcnF3TDdLNnNDMURhckFpVTZxd0lwT3FzQ0xUcXJBcjAtcXdKRVFhc0Nya0dyQW14S3F3SmdUcXNDdUU2ckFoMVFxd0lmVUtzQzlGQ3JBZ0pScXdJS1Vhc0NJRnlyQXNObnF3SV9hcXNDR1hHckF2Qnhxd0pfYzZzQ3luU3JBaGQzcXdJYmQ2c0NJSGVyQWlWM3F3SXFkNnNDczNpckFnaDVxd0t5ZnFzQ1VvQ3JBa3FCcXdLY2dhc0NvWUdyQXNxQ3F3TERoS3NDVm9lckFuS0hxd0tmaXFzQ19JdXJBaFNNcXdLeGpLc0N0SXlyQWlXUXF3SmNrcXNDcUplckFsNmFxd0p4bjZzQ3VaLXJBbXlocXdLem9xc0NscVNyQXNta3F3S2NwcXNDRjZxckF0dXJxd0trcktzQ1FxNnJBanV2cXdMeHI2c0N4N0NyQXNleHF3SkFzcXNDU0xLckFtS3lxd0lQczZzQ1g3T3JBdTJ6cXdJV3RLc0NHclNyQWlHMHF3SWx0S3NDS2JTckFveTJxd0xMdHFzQzY3YXJBajYzcXdKUHQ2c0NYcmVyQW8yM3F3SzF0NnNDMHJlckF0MjNxd0lUdUtzQzVMaXJBaUc1cXdMNXVhc0NKcnFyQWpXNnF3Sjd1cXNDdUxxckFsaTdxd0lndktzQ1RyeXJBdVc4cXdMSXZhc0NsTzBGQTVwMEpBVEFkU1FFQlY3M0JFRmU5d1RZZDY0RmxYaXVCUTk2cmdWbmU2NEZtWHV1QlFkOHJnVkZ0TVVGMFlZakNsbTEteEw4eF9zU1pRNzhFajRWX0JKckZmd1M5QmY4RW5rWV9CTG5IZndTNlIzOEV2QWRfQklTSHZ3U0xCNzhFcUFlX0JMWkh2d1NZUl84RXM4Zl9CSmJuLW9VLUZackdySHdXU2hoaWVGWiZleGs9MbVazaUAY82l8NBDSWNaSEo0elNYdGE4VkIyZVpYMWFVUXRGZXFzRWZrTWJ3MGpwcjcteGFrRk1JQUhidzh6My1OT1g1YzhBYUp2U2k4SFpReHF3N2dWNU4xTDZSbHBXbVdZYlJkQ2lyVk4zTDBTQjBPYTRObWRad1ZBbWVEdDhXbkZ6c29helU5eGdSVVFjOEtZdm1Ga0MwR2R3bVpVYzlPdWstb2lBSDFJU01ELTliREJadXFFMWZ2OFJaY2VTMkJXcE8tTW5PTGVpeUx2a0omYXdiaWRfZD1BS-F69JAERDBUNEVBbWVySEdJUkd6am1vZFE4ZGVOZlNOQUh0M21lT3Y2RnZPS3dIQUJ5VjNyZDZmV1N3QzcyRGlGWFZtTDB6dzhnUmtGczBwYk14VmZ3ajJYTlZ6YmpVSTZ0ZVNPWTZTRG04ckQxT0JvcGc1dzVDUWFpU0t4Xzc4d2x3TFdWbDBBd3VtOHlUbWtqa0NnM0x0MWlxejBvbno1dks4OGxFajZ4T3lOZzh1YXBQa2tTNzlLcFB5S3QyM3JjX0xSWXBHV2tyZ2tZaFM5WXpyV3ZUeFp6THBLcmtTWGJyZnNwQ2IwSG8ycUNCcnhGcFFtNHl5bGctTGp5WmNsRFlyU2xad3VuSkhZQzhiYm4tUVpTbVNFb3dTdFhFTmtGYWxpMFFZN25tT0k5WVZrTUxNaFI1Q3FOM0s2NkFQZGpyb2pqSW9uOWdubHMwRm0wWXExSER6X041Nk5qdzJSRHFhT3BaRERoQkVTNXJ3QlZacE5lWnBmQ2N4MF9adEk1LVJqbk51cm5VNE5wNFlGZV80MmszT3lwUk52SG1BTFNqLVd0R0RDRHN0eXZzd2p0M3VPM1V2dE5aVWFCcnlQNmltaExQZW1jTGprMllmSU9LTzV0MWd3Mk1OR0w2NGhsZEpLYWFwLW5hWmNXZm1xSWZGQktUS0syVzl0QzZBTWZ1TElzcHVSRDJ6b1lVdEEyVG5adVhyanJwY1M3b0JyeE5tcjJoUEFnZjcxWEdQbkZ5dmxuXzl0OThlNVQ0NDFSQmtkeFhJal9DbnhIT19TLVBJNlZvcm13bXQxUXlWcUdIc0Y5ank0UHlLOVZLZXZBMWFVeWNsMTFHQ0dzRmItYlhtX1dvZzM1TFJjNUhObVk2WVpYS0JDRFQxY0xOdlk0ZHlCRE93N0FndW0zaUZZTnlRaGcyZlhTSU1TcVgtMEc2c1B2TjBzV01IUEFyZExMejlLSlpJU3hMbS1PME00MVNfZ2FHQWR1aEtHS0xIcFJrSjNob0FXVG9WRHZJUDF1cGlCUjhmMUZDUTVKY2RvSFRFU1JHcTM1VFRqVHNsRFdFQ0hDY1NneVZJdjBzcmxRN1JNazFfcWF4ZTRYV1ludjl4YkdraGF0RzUwWV8yTE45eGF6clduSVFwRHJjRm1fbWh4OXp1WUhRWjMxLVB6cUhKd2hON0wxMzdULUM5VFREcG9ueTc1VnRIY1hVNHRtNjJ2M0FWN1RVZ1U2bkFnSFVrdl9BYUxYWUZWZGc2UzdNX0tZcm9td3NIV3RLT1RXYjEtT3pJSlB0cS1YV3FWNUhtemFnUnhmMmNOel9Wc2JuZDc2S2Q3X3NfaG90ZG4zLUpxMFQzeGpGTlUyUFNHb1RTdzMwY0g0bXUtZEpELTFOdG91M09BOE9VVTFjMHcmY2lkPUNBUVNHd0F2SGhmXzIxSnVWQ3l5aGg0eTFVNU1pcUZNUDJBZ3c2WjhnUmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3ASpw5-MAzw10RSRTV0R3NoYjc3VEJrZzlXcVFZbzg4bFExRllPMjFvMm9BenlzVGtaQ2U2RnFqT3NHWWtUZTAyY0R5LTRseWJqQkhWck9hanpLWFZYWnhQcGw5RFJyR0gzb3UwQ0hrUFd2VGZNV2ZwOENNQWZrZGFvJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzYzOTMxNzMzODM0MTEyMzExNjkiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIECzg2Lh4bC_BtqAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBZ_ds57_gYSQRaoFKjhlMDdiZjIyLWUyMGQtNGI4NS1hOWI4LTgzYjY2YmJjOTk0YX43MTV-McAFAMkFAAAO_xkU8D_SBQkJAQoBATTYBQHgBQHwBdKVVvoFBAGIKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAbds4AYB8gYCCACABwGIBwCgBwGqBwwxNTgyMTI5NQ64DBzIB-ziBdIHDRV0ATUI2gcGAW2wGADgBwDqBwIIAPAH57EJiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=cff31e26a4f7a56f5869cabd2559c24df66ec18a

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKTNvBMExsAAAMA1gAFAQjL7vmrBhDB09XNnarH3FgY1IPc1aLh3f9uKjYJqMMKt3wkJ0AR6L9iaNCrI0AZAAAAIIXrOkAh6L9iaNCrI0ApqMMJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQEG9I4BmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiQ3ZGY4YTJlNi0zZmI0LTQ3NTctYjBjNS03OWVlN2QxMDg3YTnYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTUwMTc5MzI5OfICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO2Z1bmN0aW9uIGwoYSl7bFsiICJdKGEpO3JldHVybiBhfWxbIiAiXT1mdW5jdGlvbigpe307AUZkbT1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj8VKyxhLGMpe3JldHVybiBaLQAQLmNhbGwBKSQsdm9pZCAwKX06Nj8ANGlmKCJzdHJpbmciPT09AWgQb2YgYSkJVhEaACEVGkhjfHwxIT1jLmxlbmd0aD8tMTphEZgkKGMsMCk7Zm9yKAG_GGU9MDtlPGENKVw7ZSsrKWlmKGUgaW4gYSYmYVtlXT09PWMNaAwgZTtyBccMLTF9OxGgHCBuKGEpe2E9Cbk4PT09YT9kb2N1bWVudDphDTAsIGEuY3JlYXRlRWxlARkYKCJpbWciKR1FAHAF_QhlKXsBlRRiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlwQpOwHjCWsEZj0RyAQoKSFlDRcEZz1aUwA8LGg9bShnLGQpOzA8PWgmJj7QARRzcGxpY2Upz3RnLGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqADBiJiYoZC5hdHRyaWJ1YbMUU3JjPSIiAb4Qc3JjPWNetwEkLnB1c2goZCl9CllLBHEoKZYEYT0xrDQuY3VycmVudFNjcmlwdE1PACgybgIsbnVsbDphKSYmIjc3YR0UYS5nZXRBDZA4ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RTfwTHI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0gV0AdBXgAGsFYQxjPVtdBQkEZT0Bxgw7ZG97Qa8YYj1hO3RyeQUMAGRBrRhkPSEhYiYmASQcIT1iLmxvY2EhaiAuaHJlZiliOnsBLZBsKGIuZm9vKTtkPSEwO2JyZWFrIGJ9Y2F0Y2goaCl7fWQ9ITF9AV4IZj1kGRcAZgEWDGlmKGYpeQBnPl4ADDtlPWJ1OQQmJhkMKC5yZWZlcnJlcnx8AZckfWVsc2UgZz1lLA3LAGMp4DBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9MfX13aGlsZShhJiZiIT1hKTtiPTCFqQBhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwArQwAPR11ACmhLxRhPTE7YTyxVEw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEcMDw9ZTstLWWhrEhmPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRR0KCksYz3Z3jwiPyIpO3NldFRpbWVvdXQoEYwNMQBl2VYYZT8uMDE6ZUE1RCEoTWF0aC5yYW5kb20oKT5lKWkPDGI9cSghpAAiZf80Oi8vIisoYiYmInRydWWBawBiVmsEOC1yY2QiKT8icGFnZWFkMs23EHN5bmRpabkgLWNuLmNvbSI6ZiMABSAMKSsiLwlFeC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSKFRQxkPShkAbEAKaG2UgQFAC0NMTAiKXx8InVua25vd24iYeNcK2QrIiZzYW1wbGU9IitlO2I9d2luZG93BVgAZjk0AGbhigBmITM0ZD1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSZsgZCkmJiEvRWRnGREcPyEwOiExO2RhkxVRMC5zZW5kQmVhY29uPwodaR0YIChlKTpwKGIsZRozCQQ9PQ2eCCl9fQ7iCBaqCCggMDw9Yz9hLnN1YhY_CRwoMCxjKTphfQngDC5yZmwuAggNNWhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJ5SmVUZVZpckM4Y1JlWHBIM3VZOWQwbjg3QXEyTy1TcWJpZGtVWjluQjJFdXItaHQzRGxFVjBMaHBna2dNTW5FRGtvR3NJZnN5Wm9fRzNCUmxJSThPSFB1WktwaE5STWJTdGVJemY2SHBZcnZMMTA0IiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL3xkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfUxovDAiJATwpfzYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUJSwA-DVMAPp05HCB7cjNweCgnJrsMHCcpO30pKCk7XQAQ_RQKEEgBnjRQT1JUX1BBUkFNUxLoFJE5ipUA8IZhZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTg2LjQ4LjE1Ljc5Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9JqiBfc3RhcnQ9MSallQRueVYhDhAmc3ViXw2TAGJBr_B9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1EclU1Z0FWa2lFQlBuUTBBY1NETkFFTGxEUUJFcFEwQVlLVk5BRjBsalFCZHBZMEFhMldOQUhtbGpRQjY1WTBBZi1YTkFFRG1EUUJDWmcwQVNTWU5BRTNtRFFCUTVnMEFaU1lOQUdqARAscFpnMEFiU1lOQUc0ARAsNDVnMEFlZVlOQUgwARBYOXBnMEFRNlpOQUVUbVRRQkZwazBBUnkBEAByARAUU1prMEFVARAERk8BEABVARAYV0daTkFGbwEQ9MMIUzNOQkFWTnpRUUZZYzBFQlF4MWNBb0VmWEFMX19ZZ0NKMEtxQWloQ3FnTC1lS29DUm9tcUFvQ2JxZ0tCbTZvQ2dwdXFBcUtvcWdMbHJLb0NmODJxQW5YYXFnSlYtS29DRFBxcUFpYjdxZ0pCLTZvQ0F4U3JBdU1mcXdKVUlLc0NYU0dyQWp3anF3S0VKNnNDVkNpckFqWXJxd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQXIwLXF3SkVRYXNDcmtHckFteEtxd0pnVHFzQ3VFNnJBaDFRcXdJZlVLc0M5RkNyQWdKUnF3SUtVYXNDSUZ5ckFzTm5xd0lfYXFzQ0dYR3JBdkJ4cXdKX2M2c0N5blNyQWhkM3F3SWJkNnNDSUhlckFpVjNxd0lxZDZzQ3MzaXJBZ2g1cXdLeWZxc0NVb0NyQWtxQnF3S2NnYXNDb1lHckFzcUNxd0xEaEtzQ1ZvZXJBbktIcXdLZmlxc0NfSXVyQWhTTXF3S3hqS3NDdEl5ckFpV1Fxd0pja3FzQ3FKZXJBbDZhcXdKeG42c0N1Wi1yQW15aHF3S3pvcXNDbHFTckFzbWtxd0tjcHFzQ0Y2cXJBdHVycXdLa3JLc0NRcTZyQWp1dnF3THhyNnNDeDdDckFzZXhxd0pBc3FzQ1NMS3JBbUt5cXdJUHM2c0NYN09yQXUyenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBb3kycXdMTHRxc0M2N2FyQWo2M3F3SlB0NnNDWHJlckFvMjNxd0sxdDZzQzByZXJBdDIzcXdJVHVLc0M1TGlyQWlHNXF3TDV1YXNDSnJxckFqVzZxd0o3dXFzQ3VMcXJBbGk3cXdJZ3ZLc0NUcnlyQXVXOHF3TEl2YXNDbE8wRkE1cDBKQVRBZFNRRUJWNzNCRUZlOXdUWWQ2NEZsWGl1QlE5NnJnVm5lNjRGbVh1dUJRZDhyZ1ZGdE1VRjBZWWpDbG0xLXhMOHhfc1NaUTc4RWo0Vl9CSnJGZndTOUJmOEVua1lfQkxuSGZ3UzZSMzhFdkFkX0JJU0h2d1NMQjc4RXFBZV9CTFpIdndTWVJfOEVzOGZfQkpibi1vVS1GWnJHckh3V1NoaGllRlomZXhrPTE1MDE3OTMyOTkmYXdiaWRfYz1BS0FtZi1DSWNaSEo0elNYdGE4VkIyZVpYMWFVUXRGZXFzRWZrTWJ3MGpwcjcteGFrRk1JQUhidzh6My1OT1g1YzhBYUp2U2k4SFpReHF3N2dWNU4xTDZSbHBXbVdZYlJkQ2lyVk4zTDBTQjBPYTRObWRad1ZBbWVEdDhXbkZ6c29helU5eGdSVVFjOEtZdm1Ga0MwR2R3bVpVYzlPdWstb2lBSDFJU01ELTliREJadXFFMWZ2OFJaY2VTMkJXcE8tTW5PTGVpeUx2a0omYXdiaWRfZD1BS0FtZi1EMFQ0RUFtZXJIR0lSR3pqbW9kUThkZU5mU05BSHQzbWVPdjZGdk9Ld0hBQnlWM3JkNmZXU3dDNzJEaUZYVm1MMHp3OGdSa0ZzMHBiTXhWZndqMlhOVnpialVJNnRlU09ZNlNEbThyRDFPQm9wZzV3NUNRYWlTS3hfNzh3bHdMV1ZsMEF3dW04eVRta2prQ2czTHQxaXF6MG9uejV2Szg4bEVqNnhPeU5nOHVhcFBra1M3OUtwUHlLdDIzcmNfTFJZcEdXa3Jna1loUzlZenJXdlR4WnpMcEtya1NYYnJmc3BDYjBIbzJxQ0JyeEZwUW00eXlsZy1ManlaY2xEWXJTbFp3dW5KSFlDOGJibi1RWlNtU0Vvd1N0WEVOa0ZhbGkwUVk3bm1PSTlZVmtNTE1oUjVDcU4zSzY2QVBkanJvampJb245Z25sczBGbTBZcTFIRHpfTjU2Tmp3MlJEcWFPcFpERGhCRVM1cndCVlpwTmVacGZDY3gwX1p0STUtUmpuTnVyblU0TnA0WUZlXzQyazNPeXBSTnZIbUFMU2otV3RHRENEc3R5dnN3anQzdU8zVXZ0TlpVYUJyeVA2aW1oTFBlbWNMamsyWWZJT0tPNXQxZ3cyTU5HTDY0aGxkSkthYXAtbmFaY1dmbXFJZkZCS1RLSzJXOXRDNkFNZnVMSXNwdVJEMnpvWVV0QTJUblp1WHJqcnBjUzdvQnJ4Tm1yMmhQQWdmNzFYR1BuRnl2bG5fOXQ5OGU1VDQ0MVJCa2R4WElqX0NueEhPX1MtUEk2Vm9ybXdtdDFReVZxR0hzRjlqeTRQeUs5VktldkExYVV5Y2wxMUdDR3NGYi1iWG1fV29nMzVMUmM1SE5tWTZZWlhLQkNEVDFjTE52WTRkeUJET3c3QWd1bTNpRllOeVFoZzJmWFNJTVNxWC0wRzZzUHZOMHNXTUhQQXJkTEx6OUtKWklTeExtLU8wTTQxU19nYUdBZHVoS0dLTEhwUmtKM2hvQVdUb1ZEdklQMXVwaUJSOGYxRkNRNUpjZG9IVEVTUkdxMzVUVGpUc2xEV0VDSENjU2d5Vkl2MHNybFE3Uk1rMV9xYXhlNFhXWW52OXhiR2toYXRHNTBZXzJMTjl4YXpyV25JUXBEcmNGbV9taHg5enVZSFFaMzEtUHpxSEp3aE43TDEzN1QtQzlUVERwb255NzVWdEhjWFU0dG02MnYzQVY3VFVnVTZuQWdIVWt2X0FhTFhZRlZkZzZTN01fS1lyb213c0hXdEtPVFdiMS1PeklKUHRxLVhXcVY1SG16YWdSeGYyY056X1ZzYm5kNzZLZDdfc19ob3RkbjMtSnEwVDN4akZOVTJQU0dvVFN3MzBjSDRtdS1kSkQtMU50b3UzT0E4T1VVMWMwdyZjaWQ9Q0FRU0d3QXZIaGZfMjFKdVZDeXloaDR5MVU1TWlxRk1QMkFndzZaOGdSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP8AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzJokOqjAM8NdEUkU1dEdzaGI3N1RCa2c5V3FRWW84OGxRMUZZTzIxbzJvQXp5c1RrWkNlNkZxak9zR1lrVGUwMmNEeS00bHliakJIVnJPYWp6S1hWWFp4UHBsOURSckdIM291MENIa1BXdlRmTVdmcDhDTUFma2RhbyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM2MzkzMTczMzgzNDExMjMxMTY5Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBAs4Ni4eGwvwbagEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8AShn-kkiAUBmAUAoAWf3bOe_4GEkEWqBSo4ZTA3YmYyMi1lMjBkLTRiODUtYTliOC04M2I2NmJiYzk5NGF-NzE1fjHABQDJBQAADgAaFPA_0gUJCQEKAQE02AUB4AUB8AXSlVb6BQQBiCiQBgCYBgC4BgDBBgEhNAAA8D_QBu6PAdoGFgoQCRIZAQG3oOAGAfIGAggAgAcBiAcAoAcBqgcMMTU4MjEyOTU5MzI5yAfs4gXSBw0JETcBNQjaBwYBbbAYAOAHAOoHAggA8AfnsQmKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=bad850e4eeaf3a009ad1af1bd0e650857d360eb9&pp=9.835574

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

be05a934996d0aefe665cd32371d48d6938ee6a97c267ab0a8a69fb7283017ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 0d0f45a9-7db4-4adb-9209-9d2bc72748bc
cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 17 Dec 2023 04:21:31 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
vary: Accept-Encoding
x-creative-id: 77221793
x-proxy-origin: 86.48.15.79; 86.48.15.79; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C59B 52 KB
17 KB 105ms
34ms Document
text/html 23.195.100.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKTNvBMExsAAAMA1gAFAQjL7vmrBhDB09XNnarH3FgY1IPc1aLh3f9uKjYJqMMKt3wkJ0AR6L9iaNCrI0AZAAAAIIXrOkAh6L9iaNCrI0ApqMMJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQEG9I4BmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiQ3ZGY4YTJlNi0zZmI0LTQ3NTctYjBjNS03OWVlN2QxMDg3YTnYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTUwMTc5MzI5OfICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO2Z1bmN0aW9uIGwoYSl7bFsiICJdKGEpO3JldHVybiBhfWxbIiAiXT1mdW5jdGlvbigpe307AUZkbT1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj8VKyxhLGMpe3JldHVybiBaLQAQLmNhbGwBKSQsdm9pZCAwKX06Nj8ANGlmKCJzdHJpbmciPT09AWgQb2YgYSkJVhEaACEVGkhjfHwxIT1jLmxlbmd0aD8tMTphEZgkKGMsMCk7Zm9yKAG_GGU9MDtlPGENKVw7ZSsrKWlmKGUgaW4gYSYmYVtlXT09PWMNaAwgZTtyBccMLTF9OxGgHCBuKGEpe2E9Cbk4PT09YT9kb2N1bWVudDphDTAsIGEuY3JlYXRlRWxlARkYKCJpbWciKR1FAHAF_QhlKXsBlRRiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlwQpOwHjCWsEZj0RyAQoKSFlDRcEZz1aUwA8LGg9bShnLGQpOzA8PWgmJj7QARRzcGxpY2Upz3RnLGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqADBiJiYoZC5hdHRyaWJ1YbMUU3JjPSIiAb4Qc3JjPWNetwEkLnB1c2goZCl9CllLBHEoKZYEYT0xrDQuY3VycmVudFNjcmlwdE1PACgybgIsbnVsbDphKSYmIjc3YR0UYS5nZXRBDZA4ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RTfwTHI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0gV0AdBXgAGsFYQxjPVtdBQkEZT0Bxgw7ZG97Qa8YYj1hO3RyeQUMAGRBrRhkPSEhYiYmASQcIT1iLmxvY2EhaiAuaHJlZiliOnsBLZBsKGIuZm9vKTtkPSEwO2JyZWFrIGJ9Y2F0Y2goaCl7fWQ9ITF9AV4IZj1kGRcAZgEWDGlmKGYpeQBnPl4ADDtlPWJ1OQQmJhkMKC5yZWZlcnJlcnx8AZckfWVsc2UgZz1lLA3LAGMp4DBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9MfX13aGlsZShhJiZiIT1hKTtiPTCFqQBhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwArQwAPR11ACmhLxRhPTE7YTyxVEw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEcMDw9ZTstLWWhrEhmPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRR0KCksYz3Z3jwiPyIpO3NldFRpbWVvdXQoEYwNMQBl2VYYZT8uMDE6ZUE1RCEoTWF0aC5yYW5kb20oKT5lKWkPDGI9cSghpAAiZf80Oi8vIisoYiYmInRydWWBawBiVmsEOC1yY2QiKT8icGFnZWFkMs23EHN5bmRpabkgLWNuLmNvbSI6ZiMABSAMKSsiLwlFeC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSKFRQxkPShkAbEAKaG2UgQFAC0NMTAiKXx8InVua25vd24iYeNcK2QrIiZzYW1wbGU9IitlO2I9d2luZG93BVgAZjk0AGbhigBmITM0ZD1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSZsgZCkmJiEvRWRnGREcPyEwOiExO2RhkxVRMC5zZW5kQmVhY29uPwodaR0YIChlKTpwKGIsZRozCQQ9PQ2eCCl9fQ7iCBaqCCggMDw9Yz9hLnN1YhY_CRwoMCxjKTphfQngDC5yZmwuAggNNWhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJ5SmVUZVZpckM4Y1JlWHBIM3VZOWQwbjg3QXEyTy1TcWJpZGtVWjluQjJFdXItaHQzRGxFVjBMaHBna2dNTW5FRGtvR3NJZnN5Wm9fRzNCUmxJSThPSFB1WktwaE5STWJTdGVJemY2SHBZcnZMMTA0IiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL3xkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfUxovDAiJATwpfzYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUJSwA-DVMAPp05HCB7cjNweCgnJrsMHCcpO30pKCk7XQAQ_RQKEEgBnjRQT1JUX1BBUkFNUxLoFJE5ipUA8IZhZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTg2LjQ4LjE1Ljc5Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9JqiBfc3RhcnQ9MSallQRueVYhDhAmc3ViXw2TAGJBr_B9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1EclU1Z0FWa2lFQlBuUTBBY1NETkFFTGxEUUJFcFEwQVlLVk5BRjBsalFCZHBZMEFhMldOQUhtbGpRQjY1WTBBZi1YTkFFRG1EUUJDWmcwQVNTWU5BRTNtRFFCUTVnMEFaU1lOQUdqARAscFpnMEFiU1lOQUc0ARAsNDVnMEFlZVlOQUgwARBYOXBnMEFRNlpOQUVUbVRRQkZwazBBUnkBEAByARAUU1prMEFVARAERk8BEABVARAYV0daTkFGbwEQ9MMIUzNOQkFWTnpRUUZZYzBFQlF4MWNBb0VmWEFMX19ZZ0NKMEtxQWloQ3FnTC1lS29DUm9tcUFvQ2JxZ0tCbTZvQ2dwdXFBcUtvcWdMbHJLb0NmODJxQW5YYXFnSlYtS29DRFBxcUFpYjdxZ0pCLTZvQ0F4U3JBdU1mcXdKVUlLc0NYU0dyQWp3anF3S0VKNnNDVkNpckFqWXJxd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQXIwLXF3SkVRYXNDcmtHckFteEtxd0pnVHFzQ3VFNnJBaDFRcXdJZlVLc0M5RkNyQWdKUnF3SUtVYXNDSUZ5ckFzTm5xd0lfYXFzQ0dYR3JBdkJ4cXdKX2M2c0N5blNyQWhkM3F3SWJkNnNDSUhlckFpVjNxd0lxZDZzQ3MzaXJBZ2g1cXdLeWZxc0NVb0NyQWtxQnF3S2NnYXNDb1lHckFzcUNxd0xEaEtzQ1ZvZXJBbktIcXdLZmlxc0NfSXVyQWhTTXF3S3hqS3NDdEl5ckFpV1Fxd0pja3FzQ3FKZXJBbDZhcXdKeG42c0N1Wi1yQW15aHF3S3pvcXNDbHFTckFzbWtxd0tjcHFzQ0Y2cXJBdHVycXdLa3JLc0NRcTZyQWp1dnF3THhyNnNDeDdDckFzZXhxd0pBc3FzQ1NMS3JBbUt5cXdJUHM2c0NYN09yQXUyenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBb3kycXdMTHRxc0M2N2FyQWo2M3F3SlB0NnNDWHJlckFvMjNxd0sxdDZzQzByZXJBdDIzcXdJVHVLc0M1TGlyQWlHNXF3TDV1YXNDSnJxckFqVzZxd0o3dXFzQ3VMcXJBbGk3cXdJZ3ZLc0NUcnlyQXVXOHF3TEl2YXNDbE8wRkE1cDBKQVRBZFNRRUJWNzNCRUZlOXdUWWQ2NEZsWGl1QlE5NnJnVm5lNjRGbVh1dUJRZDhyZ1ZGdE1VRjBZWWpDbG0xLXhMOHhfc1NaUTc4RWo0Vl9CSnJGZndTOUJmOEVua1lfQkxuSGZ3UzZSMzhFdkFkX0JJU0h2d1NMQjc4RXFBZV9CTFpIdndTWVJfOEVzOGZfQkpibi1vVS1GWnJHckh3V1NoaGllRlomZXhrPTE1MDE3OTMyOTkmYXdiaWRfYz1BS0FtZi1DSWNaSEo0elNYdGE4VkIyZVpYMWFVUXRGZXFzRWZrTWJ3MGpwcjcteGFrRk1JQUhidzh6My1OT1g1YzhBYUp2U2k4SFpReHF3N2dWNU4xTDZSbHBXbVdZYlJkQ2lyVk4zTDBTQjBPYTRObWRad1ZBbWVEdDhXbkZ6c29helU5eGdSVVFjOEtZdm1Ga0MwR2R3bVpVYzlPdWstb2lBSDFJU01ELTliREJadXFFMWZ2OFJaY2VTMkJXcE8tTW5PTGVpeUx2a0omYXdiaWRfZD1BS0FtZi1EMFQ0RUFtZXJIR0lSR3pqbW9kUThkZU5mU05BSHQzbWVPdjZGdk9Ld0hBQnlWM3JkNmZXU3dDNzJEaUZYVm1MMHp3OGdSa0ZzMHBiTXhWZndqMlhOVnpialVJNnRlU09ZNlNEbThyRDFPQm9wZzV3NUNRYWlTS3hfNzh3bHdMV1ZsMEF3dW04eVRta2prQ2czTHQxaXF6MG9uejV2Szg4bEVqNnhPeU5nOHVhcFBra1M3OUtwUHlLdDIzcmNfTFJZcEdXa3Jna1loUzlZenJXdlR4WnpMcEtya1NYYnJmc3BDYjBIbzJxQ0JyeEZwUW00eXlsZy1ManlaY2xEWXJTbFp3dW5KSFlDOGJibi1RWlNtU0Vvd1N0WEVOa0ZhbGkwUVk3bm1PSTlZVmtNTE1oUjVDcU4zSzY2QVBkanJvampJb245Z25sczBGbTBZcTFIRHpfTjU2Tmp3MlJEcWFPcFpERGhCRVM1cndCVlpwTmVacGZDY3gwX1p0STUtUmpuTnVyblU0TnA0WUZlXzQyazNPeXBSTnZIbUFMU2otV3RHRENEc3R5dnN3anQzdU8zVXZ0TlpVYUJyeVA2aW1oTFBlbWNMamsyWWZJT0tPNXQxZ3cyTU5HTDY0aGxkSkthYXAtbmFaY1dmbXFJZkZCS1RLSzJXOXRDNkFNZnVMSXNwdVJEMnpvWVV0QTJUblp1WHJqcnBjUzdvQnJ4Tm1yMmhQQWdmNzFYR1BuRnl2bG5fOXQ5OGU1VDQ0MVJCa2R4WElqX0NueEhPX1MtUEk2Vm9ybXdtdDFReVZxR0hzRjlqeTRQeUs5VktldkExYVV5Y2wxMUdDR3NGYi1iWG1fV29nMzVMUmM1SE5tWTZZWlhLQkNEVDFjTE52WTRkeUJET3c3QWd1bTNpRllOeVFoZzJmWFNJTVNxWC0wRzZzUHZOMHNXTUhQQXJkTEx6OUtKWklTeExtLU8wTTQxU19nYUdBZHVoS0dLTEhwUmtKM2hvQVdUb1ZEdklQMXVwaUJSOGYxRkNRNUpjZG9IVEVTUkdxMzVUVGpUc2xEV0VDSENjU2d5Vkl2MHNybFE3Uk1rMV9xYXhlNFhXWW52OXhiR2toYXRHNTBZXzJMTjl4YXpyV25JUXBEcmNGbV9taHg5enVZSFFaMzEtUHpxSEp3aE43TDEzN1QtQzlUVERwb255NzVWdEhjWFU0dG02MnYzQVY3VFVnVTZuQWdIVWt2X0FhTFhZRlZkZzZTN01fS1lyb213c0hXdEtPVFdiMS1PeklKUHRxLVhXcVY1SG16YWdSeGYyY056X1ZzYm5kNzZLZDdfc19ob3RkbjMtSnEwVDN4akZOVTJQU0dvVFN3MzBjSDRtdS1kSkQtMU50b3UzT0E4T1VVMWMwdyZjaWQ9Q0FRU0d3QXZIaGZfMjFKdVZDeXloaDR5MVU1TWlxRk1QMkFndzZaOGdSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP8AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzJokOqjAM8NdEUkU1dEdzaGI3N1RCa2c5V3FRWW84OGxRMUZZTzIxbzJvQXp5c1RrWkNlNkZxak9zR1lrVGUwMmNEeS00bHliakJIVnJPYWp6S1hWWFp4UHBsOURSckdIM291MENIa1BXdlRmTVdmcDhDTUFma2RhbyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM2MzkzMTczMzgzNDExMjMxMTY5Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBAs4Ni4eGwvwbagEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8AShn-kkiAUBmAUAoAWf3bOe_4GEkEWqBSo4ZTA3YmYyMi1lMjBkLTRiODUtYTliOC04M2I2NmJiYzk5NGF-NzE1fjHABQDJBQAADgAaFPA_0gUJCQEKAQE02AUB4AUB8AXSlVb6BQQBiCiQBgCYBgC4BgDBBgEhNAAA8D_QBu6PAdoGFgoQCRIZAQG3oOAGAfIGAggAgAcBiAcAoAcBqgcMMTU4MjEyOTU5MzI5yAfs4gXSBw0JETcBNQjaBwYBbbAYAOAHAOoHAggA8AfnsQmKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=bad850e4eeaf3a009ad1af1bd0e650857d360eb9&pp=9.835574
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.195.100.202 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-100-202.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 17 Dec 2023 04:21:31 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 18 Dec 2023 04:21:33 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Unused62: 8096267
Vary: Accept-Encoding

GET
H2 200 rd_log Show response
lax1-ib.adnxs.com/ Frame 1B54 0
644 B 150ms
149ms Script
text/html 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/rd_log?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKWNPQnBBYaAAADANYABQEIy-75qwYQwdPVzZ2qx9xYGNSD3NWi4d3_bio2CS9xQKd8JCdAEZvG9lrQqyNAGQAAACCF6zpAIei_YmjQqyNAKajDCrd8JCdAMQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJDdkZjhhMmU2LTNmYjQtNDc1Ny1iMGM1LTc5ZWU3ZDEwODdhOdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIYCgpJRlJBTUVfS0VZEgoxNTAxNzkzMjk58gLIFQoLUFJFX1NDUklQVFMSuBU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBrPXRoaXN8fHNlbGY7ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTt2YXIgbT1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbihhKXthPXZvaWQgMD09PWE_ZG9jdW1lbnQ6YTtyZXR1cm4gYS5jcmVhdGVFbGVtZW50KCJpbWciKX07ZnVuY3Rpb24gcChhLGMsZSl7dmFyIGI9ITE7Yj12b2lkIDA9PT1iPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSk7dmFyIGQ9bihhLmRvY3VtZW50KTtpZihlKXt2YXIgZj1mdW5jdGlvbigpe2lmKGUpe3ZhciBnPWEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzLGg9bShnLGQpOzA8PWgmJkFycmF5LnByb3RvIXuoLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAWGImJihkLmF0dHJpYnV0aW9uU3JjPSIiAb4kc3JjPWM7YS5nb0q3ASwucHVzaChkKX0KO2Zt7RAgcSgpe2GbXGE9ZG9jdW1lbnQuY3VycmVudFNjcmlwdE1PDChhPXZlJ0Q9PT1hP251bGw6YSkmJiI3NyIBEhAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQQXScpfTsBh_BScj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgR4ABrBWEMYz1bXQUJBGU9AcYIO2RvBf8YYj1hO3RyeQUMLGQ7aWYoZD0hIWImJgEkHCE9Yi5sb2NhIWogLmhyZWYpYjp7AS2QbChiLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKGgpe31kPSExfQHWCGY9ZBkXAGYBFgxpZihmCZkAZz5eAAw7ZT1idTkEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZSwNywBjKeAwbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_8EB9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlbmd0aC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9ayErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaxmrIdVl_wBnJRYlAgRlPTIEASAwPD1lOy0tZSkhukQ9Y1tlXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfXXQMHYoYSxjKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQoAfZkpAHeVKRh0KCksYz1h8UlAKCI_Iik7c2V0VGltZW91dCgRjA0xAGWZOhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyrQAQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQUZj8hMTpmITM0ZD1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSZsgZCkmJiEvRWRnGREcPyEwOiExO2RhkxVRMC5zZW5kQmVhY29uPwodaR0YJChlKTpwKGIsZSzVDAmeECl9fSwwVaBcMDw9Yz9hLnN1YnN0cmluZygwLGMpOmF9CeAQLnJmbD1dIwhyZXQOpgloZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CeUplVGVWaXJDOGNSZVhwSDN1WTlkMG44N0FxMk8tU3FiaWRrVVo5bkIyRXVyLWh0M0RsRVYwTGhwZ2tnTU1uRURrb0dzSWZzeVpvX0czQlJsSUk4T0hQdVpLcGhOUk1iU3RlSXpmNkhwWXJ2TDEwNCIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS-oZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1NDUklQVFMSiQE8cyV_Nh0BFm4IUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEbPHhiZmVfYmFja2ZpbGwuanMBZS3KDVMAPp05NCB7cjNweCgnMTUwMTc5DrsMHCcpO30pKCk7XQAQ_RQKEEgBnjRQT1JUX1BBUkFNUxLoFJE5ipUA8IZhZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTg2LjQ4LjE1Ljc5Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9JqiBfc3RhcnQ9MSallQxueWZpTiEOECZzdWJfDZMAYkGv8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TURyVTVnQVZraUVCUG5RMEFjU0ROQUVMbERRQkVwUTBBWUtWTkFGMGxqUUJkcFkwQWEyV05BSG1salFCNjVZMEFmLVhOQUVEbURRQkNaZzBBU1NZTkFFM21EUUJRNWcwQVpTWU5BR2oBECxwWmcwQWJTWU5BRzQBECw0NWcwQWVlWU5BSDABEFg5cGcwQVE2Wk5BRVRtVFFCRnBrMEFSeQEQAHIBEBRTWmswQVUBEARGTwEQAFUBEBhXR1pOQUZvARD0VQNTM05CQVZOelFRRlljMEVCUXgxY0FvRWZYQUxfX1lnQ0owS3FBaWhDcWdMLWVLb0NSb21xQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQ2Y4MnFBblhhcWdKVi1Lb0NEUHFxQWliN3FnSkItNm9DQXhTckF1TWZxd0pVSUtzQ1hTR3JBandqcXdLRUo2c0NWQ2lyQWpZcnF3TDdLNnNDMURhckFpVTZxd0lwT3FzQ0xUcXJBcjAtcXdKRVFhc0Nya0dyQW14S3F3SmdUcXNDdUU2ckFoMVFxd0lmVUtzQzlGQ3JBZ0pScXdJS1Vhc0NJRnlyQXNObnF3SV9hcXNDR1hHckF2Qnhxd0pfYzZzQ3luU3JBaGQzcXdJYmQ2c0NJSGVyQWlWM3F3SXFkNnNDczNpckFnaDVxd0t5ZnFzQ1VvQ3JBa3FCcXdLY2dhc0NvWUdyQXNxQ3F3TERoS3NDVm9lckFuS0hxd0tmaXFzQ19JdXJBaFNNcXdLeGpLc0N0SXlyQWlXUXF3SmNrcXNDcUplckFsNmFxd0p4bjZzQ3VaLXJBbXlocXdLem9xc0NscVNyQXNta3F3S2NwcXNDRjZxckF0dXJxd0trcktzQ1FxNnJBanV2cXdMeHI2c0N4N0NyQXNleHF3SkFzcXNDU0xLckFtS3lxd0lQczZzQ1g3T3JBdTJ6cXdJV3RLc0NHclNyQWlHMHF3SWx0S3NDS2JTckFveTJxd0xMdHFzQzY3YXJBajYzcXdKUHQ2c0NYcmVyQW8yM3F3SzF0NnNDMHJlckF0MjNxd0lUdUtzQzVMaXJBaUc1cXdMNXVhc0NKcnFyQWpXNnF3Sjd1cXNDdUxxckFsaTdxd0lndktzQ1RyeXJBdVc4cXdMSXZhc0NsTzBGQTVwMEpBVEFkU1FFQlY3M0JFRmU5d1RZZDY0RmxYaXVCUTk2cmdWbmU2NEZtWHV1QlFkOHJnVkZ0TVVGMFlZakNsbTEteEw4eF9zU1pRNzhFajRWX0JKckZmd1M5QmY4RW5rWV9CTG5IZndTNlIzOEV2QWRfQklTSHZ3U0xCNzhFcUFlX0JMWkh2d1NZUl84RXM4Zl9CSmJuLW9VLUZackdySHdXU2hoaWVGWiZleGs9MbVazaUAY82l8NBDSWNaSEo0elNYdGE4VkIyZVpYMWFVUXRGZXFzRWZrTWJ3MGpwcjcteGFrRk1JQUhidzh6My1OT1g1YzhBYUp2U2k4SFpReHF3N2dWNU4xTDZSbHBXbVdZYlJkQ2lyVk4zTDBTQjBPYTRObWRad1ZBbWVEdDhXbkZ6c29helU5eGdSVVFjOEtZdm1Ga0MwR2R3bVpVYzlPdWstb2lBSDFJU01ELTliREJadXFFMWZ2OFJaY2VTMkJXcE8tTW5PTGVpeUx2a0omYXdiaWRfZD1BS-F69JAERDBUNEVBbWVySEdJUkd6am1vZFE4ZGVOZlNOQUh0M21lT3Y2RnZPS3dIQUJ5VjNyZDZmV1N3QzcyRGlGWFZtTDB6dzhnUmtGczBwYk14VmZ3ajJYTlZ6YmpVSTZ0ZVNPWTZTRG04ckQxT0JvcGc1dzVDUWFpU0t4Xzc4d2x3TFdWbDBBd3VtOHlUbWtqa0NnM0x0MWlxejBvbno1dks4OGxFajZ4T3lOZzh1YXBQa2tTNzlLcFB5S3QyM3JjX0xSWXBHV2tyZ2tZaFM5WXpyV3ZUeFp6THBLcmtTWGJyZnNwQ2IwSG8ycUNCcnhGcFFtNHl5bGctTGp5WmNsRFlyU2xad3VuSkhZQzhiYm4tUVpTbVNFb3dTdFhFTmtGYWxpMFFZN25tT0k5WVZrTUxNaFI1Q3FOM0s2NkFQZGpyb2pqSW9uOWdubHMwRm0wWXExSER6X041Nk5qdzJSRHFhT3BaRERoQkVTNXJ3QlZacE5lWnBmQ2N4MF9adEk1LVJqbk51cm5VNE5wNFlGZV80MmszT3lwUk52SG1BTFNqLVd0R0RDRHN0eXZzd2p0M3VPM1V2dE5aVWFCcnlQNmltaExQZW1jTGprMllmSU9LTzV0MWd3Mk1OR0w2NGhsZEpLYWFwLW5hWmNXZm1xSWZGQktUS0syVzl0QzZBTWZ1TElzcHVSRDJ6b1lVdEEyVG5adVhyanJwY1M3b0JyeE5tcjJoUEFnZjcxWEdQbkZ5dmxuXzl0OThlNVQ0NDFSQmtkeFhJal9DbnhIT19TLVBJNlZvcm13bXQxUXlWcUdIc0Y5ank0UHlLOVZLZXZBMWFVeWNsMTFHQ0dzRmItYlhtX1dvZzM1TFJjNUhObVk2WVpYS0JDRFQxY0xOdlk0ZHlCRE93N0FndW0zaUZZTnlRaGcyZlhTSU1TcVgtMEc2c1B2TjBzV01IUEFyZExMejlLSlpJU3hMbS1PME00MVNfZ2FHQWR1aEtHS0xIcFJrSjNob0FXVG9WRHZJUDF1cGlCUjhmMUZDUTVKY2RvSFRFU1JHcTM1VFRqVHNsRFdFQ0hDY1NneVZJdjBzcmxRN1JNazFfcWF4ZTRYV1ludjl4YkdraGF0RzUwWV8yTE45eGF6clduSVFwRHJjRm1fbWh4OXp1WUhRWjMxLVB6cUhKd2hON0wxMzdULUM5VFREcG9ueTc1VnRIY1hVNHRtNjJ2M0FWN1RVZ1U2bkFnSFVrdl9BYUxYWUZWZGc2UzdNX0tZcm9td3NIV3RLT1RXYjEtT3pJSlB0cS1YV3FWNUhtemFnUnhmMmNOel9Wc2JuZDc2S2Q3X3NfaG90ZG4zLUpxMFQzeGpGTlUyUFNHb1RTdzMwY0g0bXUtZEpELTFOdG91M09BOE9VVTFjMHcmY2lkPUNBUVNHd0F2SGhmXzIxSnVWQ3l5aGg0eTFVNU1pcUZNUDJBZ3c2WjhnUmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoDAMAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBAs4Ni4eHgrwbagEALIEDAgAEAAYACAAMAA4ArgEAMAEAMgEANoEAggB4AQA8AShn-kkiAUBmAUAoAWf3bOe_4GEkEWqBSo4ZTA3YmYyMi1lMjBkLTRiODUtYTliOC04M2I2NmJiYzk5NGF-NzE1fjHABQDJBQAADgIZFPA_0gUJCQEKAQE02AUB4AUB8AXSlVb6BQQBiCiQBgCYBgC4BgDBBgEhNAAA8D_QBu6PAdoGFgoQCRIZAQG3bOAGAfIGAggAgAcBiAcAoAcBqgcMMTU4MjEyOTUOuwscyAfs4gXSBw0VdAE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=7a5ab9f2ad6e8b513fc19b6927ec9b975e42466f&bdref=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%5C%3D%7B%2522ids%2522%3A%5B%25221th5nwUM78sPPxEjluZ-P37Nv8cNdWeqF%2522%5D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%7B%7D%7D,about%3Ablank&

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
an-x-request-uuid: 1f2ef94a-a5f6-48b7-bc57-ea954a82b903
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 86.48.15.79; 86.48.15.79; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8252 0
349 B 122ms
49ms Image
image/gif 142.251.163.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-ByJeTeVirC8cReXpH3uY9d0n87Aq2O-SqbidkUZ9nB2Eur-ht3DlEV0LhpgkgMMnEDkoGsIfsyZo_G3BRlII8OHPuZKphNRMbSteIzf6HpYrvL104

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKTNvQnBBMbAAADANYABQEIy-75qwYQwdPVzZ2qx9xYGNSD3NWi4d3_bio2CS9xQKd8JCdAEZvG9lrQqyNAGQAAACCF6zpAIei_YmjQqyNAKajDCrd8JCdAMQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJDdkZjhhMmU2LTNmYjQtNDc1Ny1iMGM1LTc5ZWU3ZDEwODdhOdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIYCgpJRlJBTUVfS0VZEgoxNTAxNzkzMjk58gLIFQoLUFJFX1NDUklQVFMSuBU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBrPXRoaXN8fHNlbGY7ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTt2YXIgbT1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbihhKXthPXZvaWQgMD09PWE_ZG9jdW1lbnQ6YTtyZXR1cm4gYS5jcmVhdGVFbGVtZW50KCJpbWciKX07ZnVuY3Rpb24gcChhLGMsZSl7dmFyIGI9ITE7Yj12b2lkIDA9PT1iPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSk7dmFyIGQ9bihhLmRvY3VtZW50KTtpZihlKXt2YXIgZj1mdW5jdGlvbigpe2lmKGUpe3ZhciBnPWEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzLGg9bShnLGQpOzA8PWgmJkFycmF5LnByb3RvIXuoLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAWGImJihkLmF0dHJpYnV0aW9uU3JjPSIiAb4kc3JjPWM7YS5nb0q3ASwucHVzaChkKX0KO2Zt7RAgcSgpe2GbXGE9ZG9jdW1lbnQuY3VycmVudFNjcmlwdE1PDChhPXZlJ0Q9PT1hP251bGw6YSkmJiI3NyIBEhAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQQXScpfTsBh_BScj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgR4ABrBWEMYz1bXQUJBGU9AcYIO2RvBf8YYj1hO3RyeQUMLGQ7aWYoZD0hIWImJgEkHCE9Yi5sb2NhIWogLmhyZWYpYjp7AS2QbChiLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKGgpe31kPSExfQHWCGY9ZBkXAGYBFgxpZihmCZkAZz5eAAw7ZT1idTkEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZSwNywBjKeAwbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_8EB9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlbmd0aC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9ayErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaxmrIdVl_wBnJRYlAgRlPTIEASAwPD1lOy0tZSkhukQ9Y1tlXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfXXQMHYoYSxjKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQoAfZkpAHeVKRh0KCksYz1h8UlAKCI_Iik7c2V0VGltZW91dCgRjA0xAGWZOhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyrQAQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQUZj8hMTpmITM0ZD1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSZsgZCkmJiEvRWRnGREcPyEwOiExO2RhkxVRMC5zZW5kQmVhY29uPwodaR0YJChlKTpwKGIsZSzVDAmeECl9fSwwVaBcMDw9Yz9hLnN1YnN0cmluZygwLGMpOmF9CeAQLnJmbD1dIwhyZXQOpgloZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CeUplVGVWaXJDOGNSZVhwSDN1WTlkMG44N0FxMk8tU3FiaWRrVVo5bkIyRXVyLWh0M0RsRVYwTGhwZ2tnTU1uRURrb0dzSWZzeVpvX0czQlJsSUk4T0hQdVpLcGhOUk1iU3RlSXpmNkhwWXJ2TDEwNCIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS-oZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1NDUklQVFMSiQE8cyV_Nh0BFm4IUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEbPHhiZmVfYmFja2ZpbGwuanMBZS3KDVMAPp05NCB7cjNweCgnMTUwMTc5DrsMHCcpO30pKCk7XQAQ_RQKEEgBnjRQT1JUX1BBUkFNUxLoFJE5ipUA8IZhZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTg2LjQ4LjE1Ljc5Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9JqiBfc3RhcnQ9MSallQxueWZpTiEOECZzdWJfDZMAYkGv8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TURyVTVnQVZraUVCUG5RMEFjU0ROQUVMbERRQkVwUTBBWUtWTkFGMGxqUUJkcFkwQWEyV05BSG1salFCNjVZMEFmLVhOQUVEbURRQkNaZzBBU1NZTkFFM21EUUJRNWcwQVpTWU5BR2oBECxwWmcwQWJTWU5BRzQBECw0NWcwQWVlWU5BSDABEFg5cGcwQVE2Wk5BRVRtVFFCRnBrMEFSeQEQAHIBEBRTWmswQVUBEARGTwEQAFUBEBhXR1pOQUZvARD0VQNTM05CQVZOelFRRlljMEVCUXgxY0FvRWZYQUxfX1lnQ0owS3FBaWhDcWdMLWVLb0NSb21xQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQ2Y4MnFBblhhcWdKVi1Lb0NEUHFxQWliN3FnSkItNm9DQXhTckF1TWZxd0pVSUtzQ1hTR3JBandqcXdLRUo2c0NWQ2lyQWpZcnF3TDdLNnNDMURhckFpVTZxd0lwT3FzQ0xUcXJBcjAtcXdKRVFhc0Nya0dyQW14S3F3SmdUcXNDdUU2ckFoMVFxd0lmVUtzQzlGQ3JBZ0pScXdJS1Vhc0NJRnlyQXNObnF3SV9hcXNDR1hHckF2Qnhxd0pfYzZzQ3luU3JBaGQzcXdJYmQ2c0NJSGVyQWlWM3F3SXFkNnNDczNpckFnaDVxd0t5ZnFzQ1VvQ3JBa3FCcXdLY2dhc0NvWUdyQXNxQ3F3TERoS3NDVm9lckFuS0hxd0tmaXFzQ19JdXJBaFNNcXdLeGpLc0N0SXlyQWlXUXF3SmNrcXNDcUplckFsNmFxd0p4bjZzQ3VaLXJBbXlocXdLem9xc0NscVNyQXNta3F3S2NwcXNDRjZxckF0dXJxd0trcktzQ1FxNnJBanV2cXdMeHI2c0N4N0NyQXNleHF3SkFzcXNDU0xLckFtS3lxd0lQczZzQ1g3T3JBdTJ6cXdJV3RLc0NHclNyQWlHMHF3SWx0S3NDS2JTckFveTJxd0xMdHFzQzY3YXJBajYzcXdKUHQ2c0NYcmVyQW8yM3F3SzF0NnNDMHJlckF0MjNxd0lUdUtzQzVMaXJBaUc1cXdMNXVhc0NKcnFyQWpXNnF3Sjd1cXNDdUxxckFsaTdxd0lndktzQ1RyeXJBdVc4cXdMSXZhc0NsTzBGQTVwMEpBVEFkU1FFQlY3M0JFRmU5d1RZZDY0RmxYaXVCUTk2cmdWbmU2NEZtWHV1QlFkOHJnVkZ0TVVGMFlZakNsbTEteEw4eF9zU1pRNzhFajRWX0JKckZmd1M5QmY4RW5rWV9CTG5IZndTNlIzOEV2QWRfQklTSHZ3U0xCNzhFcUFlX0JMWkh2d1NZUl84RXM4Zl9CSmJuLW9VLUZackdySHdXU2hoaWVGWiZleGs9MbVazaUAY82l8NBDSWNaSEo0elNYdGE4VkIyZVpYMWFVUXRGZXFzRWZrTWJ3MGpwcjcteGFrRk1JQUhidzh6My1OT1g1YzhBYUp2U2k4SFpReHF3N2dWNU4xTDZSbHBXbVdZYlJkQ2lyVk4zTDBTQjBPYTRObWRad1ZBbWVEdDhXbkZ6c29helU5eGdSVVFjOEtZdm1Ga0MwR2R3bVpVYzlPdWstb2lBSDFJU01ELTliREJadXFFMWZ2OFJaY2VTMkJXcE8tTW5PTGVpeUx2a0omYXdiaWRfZD1BS-F69JAERDBUNEVBbWVySEdJUkd6am1vZFE4ZGVOZlNOQUh0M21lT3Y2RnZPS3dIQUJ5VjNyZDZmV1N3QzcyRGlGWFZtTDB6dzhnUmtGczBwYk14VmZ3ajJYTlZ6YmpVSTZ0ZVNPWTZTRG04ckQxT0JvcGc1dzVDUWFpU0t4Xzc4d2x3TFdWbDBBd3VtOHlUbWtqa0NnM0x0MWlxejBvbno1dks4OGxFajZ4T3lOZzh1YXBQa2tTNzlLcFB5S3QyM3JjX0xSWXBHV2tyZ2tZaFM5WXpyV3ZUeFp6THBLcmtTWGJyZnNwQ2IwSG8ycUNCcnhGcFFtNHl5bGctTGp5WmNsRFlyU2xad3VuSkhZQzhiYm4tUVpTbVNFb3dTdFhFTmtGYWxpMFFZN25tT0k5WVZrTUxNaFI1Q3FOM0s2NkFQZGpyb2pqSW9uOWdubHMwRm0wWXExSER6X041Nk5qdzJSRHFhT3BaRERoQkVTNXJ3QlZacE5lWnBmQ2N4MF9adEk1LVJqbk51cm5VNE5wNFlGZV80MmszT3lwUk52SG1BTFNqLVd0R0RDRHN0eXZzd2p0M3VPM1V2dE5aVWFCcnlQNmltaExQZW1jTGprMllmSU9LTzV0MWd3Mk1OR0w2NGhsZEpLYWFwLW5hWmNXZm1xSWZGQktUS0syVzl0QzZBTWZ1TElzcHVSRDJ6b1lVdEEyVG5adVhyanJwY1M3b0JyeE5tcjJoUEFnZjcxWEdQbkZ5dmxuXzl0OThlNVQ0NDFSQmtkeFhJal9DbnhIT19TLVBJNlZvcm13bXQxUXlWcUdIc0Y5ank0UHlLOVZLZXZBMWFVeWNsMTFHQ0dzRmItYlhtX1dvZzM1TFJjNUhObVk2WVpYS0JDRFQxY0xOdlk0ZHlCRE93N0FndW0zaUZZTnlRaGcyZlhTSU1TcVgtMEc2c1B2TjBzV01IUEFyZExMejlLSlpJU3hMbS1PME00MVNfZ2FHQWR1aEtHS0xIcFJrSjNob0FXVG9WRHZJUDF1cGlCUjhmMUZDUTVKY2RvSFRFU1JHcTM1VFRqVHNsRFdFQ0hDY1NneVZJdjBzcmxRN1JNazFfcWF4ZTRYV1ludjl4YkdraGF0RzUwWV8yTE45eGF6clduSVFwRHJjRm1fbWh4OXp1WUhRWjMxLVB6cUhKd2hON0wxMzdULUM5VFREcG9ueTc1VnRIY1hVNHRtNjJ2M0FWN1RVZ1U2bkFnSFVrdl9BYUxYWUZWZGc2UzdNX0tZcm9td3NIV3RLT1RXYjEtT3pJSlB0cS1YV3FWNUhtemFnUnhmMmNOel9Wc2JuZDc2S2Q3X3NfaG90ZG4zLUpxMFQzeGpGTlUyUFNHb1RTdzMwY0g0bXUtZEpELTFOdG91M09BOE9VVTFjMHcmY2lkPUNBUVNHd0F2SGhmXzIxSnVWQ3l5aGg0eTFVNU1pcUZNUDJBZ3c2WjhnUmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3ASpw5-MAzw10RSRTV0R3NoYjc3VEJrZzlXcVFZbzg4bFExRllPMjFvMm9BenlzVGtaQ2U2RnFqT3NHWWtUZTAyY0R5LTRseWJqQkhWck9hanpLWFZYWnhQcGw5RFJyR0gzb3UwQ0hrUFd2VGZNV2ZwOENNQWZrZGFvJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzYzOTMxNzMzODM0MTEyMzExNjkiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIECzg2Lh4bC_BtqAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBZ_ds57_gYSQRaoFKjhlMDdiZjIyLWUyMGQtNGI4NS1hOWI4LTgzYjY2YmJjOTk0YX43MTV-McAFAMkFAAAO_xkU8D_SBQkJAQoBATTYBQHgBQHwBdKVVvoFBAGIKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAbds4AYB8gYCCACABwGIBwCgBwGqBwwxNTgyMTI5NQ64DBzIB-ziBdIHDRV0ATUI2gcGAW2wGADgBwDqBwIIAPAH57EJiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=cff31e26a4f7a56f5869cabd2559c24df66ec18a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 8252 7 KB
4 KB 106ms
35ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0481712fe5bae84f1b02cc375afad77dc9e141437602c3a0717739654e9a003

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 03:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2455
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3350
x-xss-protection: 0
server: cafe
etag: 10582483094955927000
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 04:40:36 GMT

GET
H2 200 it
lax1-ib.adnxs.com/ Frame 8252 0
644 B 87ms
86ms Image
text/html 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lax1-ib.adnxs.com/it?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLoBvTZAmgDAAADANYABQEIy-75qwYQwdPVzZ2qx9xYGNSD3NWi4d3_bio2CS9xQKd8JCdAEZvG9lrQqyNAGQAAACCF6zpAIei_YmjQqyNAKajDCrd8JCdAMQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJDdkZjhhMmU2LTNmYjQtNDc1Ny1iMGM1LTc5ZWU3ZDEwODdhOdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA_wBCtQBaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLURSRTV0R3NoYjc3VEJrZzlXcVFZbzg4bFExRllPMjFvMm9BenlzVGtaQ2U2RnFqT3NHWWtUZTAyY0R5LTRseWJqQkhWck9hanpLWFZYWnhQcGw5RFJyR0gzb3UwQ0hrUFd2VGZNV2ZwOENNQWZrZGFvJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzYzOTMxNzMzODM0MTEyMzExNjkiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIECzg2LjQ4LjE1Ljc5qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBZ_ds57_gYSQRaoFKjhlMDdiZjIyLWUyMGQtNGI4NS1hOWI4LTgzYjY2YmJjOTk0YX43MTV-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdKVVvoFBAgAEACQBgCYBgC4BgDBBgBBhDAA8D_QBu6PAdoGFgoQBREdAbAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxNTgyMTI5NTkzMjnIB-ziBdIHDQkROAE1DNoHBggFCajgBwDqBwIIAPAH57EJiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=9fa057b3f8a071bb83783b9c0fff65ff02e957b7

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
an-x-request-uuid: fd04e9c2-6061-4c4c-baf1-d639535f9a40
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 86.48.15.79; 86.48.15.79; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/240/ Frame 8252 80 KB
28 KB 54ms
16ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/240/trk.js
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKTNvQnBBMbAAADANYABQEIy-75qwYQwdPVzZ2qx9xYGNSD3NWi4d3_bio2CS9xQKd8JCdAEZvG9lrQqyNAGQAAACCF6zpAIei_YmjQqyNAKajDCrd8JCdAMQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJDdkZjhhMmU2LTNmYjQtNDc1Ny1iMGM1LTc5ZWU3ZDEwODdhOdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIYCgpJRlJBTUVfS0VZEgoxNTAxNzkzMjk58gLIFQoLUFJFX1NDUklQVFMSuBU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBrPXRoaXN8fHNlbGY7ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTt2YXIgbT1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbihhKXthPXZvaWQgMD09PWE_ZG9jdW1lbnQ6YTtyZXR1cm4gYS5jcmVhdGVFbGVtZW50KCJpbWciKX07ZnVuY3Rpb24gcChhLGMsZSl7dmFyIGI9ITE7Yj12b2lkIDA9PT1iPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSk7dmFyIGQ9bihhLmRvY3VtZW50KTtpZihlKXt2YXIgZj1mdW5jdGlvbigpe2lmKGUpe3ZhciBnPWEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzLGg9bShnLGQpOzA8PWgmJkFycmF5LnByb3RvIXuoLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAWGImJihkLmF0dHJpYnV0aW9uU3JjPSIiAb4kc3JjPWM7YS5nb0q3ASwucHVzaChkKX0KO2Zt7RAgcSgpe2GbXGE9ZG9jdW1lbnQuY3VycmVudFNjcmlwdE1PDChhPXZlJ0Q9PT1hP251bGw6YSkmJiI3NyIBEhAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQQXScpfTsBh_BScj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgR4ABrBWEMYz1bXQUJBGU9AcYIO2RvBf8YYj1hO3RyeQUMLGQ7aWYoZD0hIWImJgEkHCE9Yi5sb2NhIWogLmhyZWYpYjp7AS2QbChiLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKGgpe31kPSExfQHWCGY9ZBkXAGYBFgxpZihmCZkAZz5eAAw7ZT1idTkEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZSwNywBjKeAwbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_8EB9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlbmd0aC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9ayErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaxmrIdVl_wBnJRYlAgRlPTIEASAwPD1lOy0tZSkhukQ9Y1tlXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfXXQMHYoYSxjKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQoAfZkpAHeVKRh0KCksYz1h8UlAKCI_Iik7c2V0VGltZW91dCgRjA0xAGWZOhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyrQAQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQUZj8hMTpmITM0ZD1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSZsgZCkmJiEvRWRnGREcPyEwOiExO2RhkxVRMC5zZW5kQmVhY29uPwodaR0YJChlKTpwKGIsZSzVDAmeECl9fSwwVaBcMDw9Yz9hLnN1YnN0cmluZygwLGMpOmF9CeAQLnJmbD1dIwhyZXQOpgloZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CeUplVGVWaXJDOGNSZVhwSDN1WTlkMG44N0FxMk8tU3FiaWRrVVo5bkIyRXVyLWh0M0RsRVYwTGhwZ2tnTU1uRURrb0dzSWZzeVpvX0czQlJsSUk4T0hQdVpLcGhOUk1iU3RlSXpmNkhwWXJ2TDEwNCIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS-oZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1NDUklQVFMSiQE8cyV_Nh0BFm4IUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEbPHhiZmVfYmFja2ZpbGwuanMBZS3KDVMAPp05NCB7cjNweCgnMTUwMTc5DrsMHCcpO30pKCk7XQAQ_RQKEEgBnjRQT1JUX1BBUkFNUxLoFJE5ipUA8IZhZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTg2LjQ4LjE1Ljc5Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9JqiBfc3RhcnQ9MSallQxueWZpTiEOECZzdWJfDZMAYkGv8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TURyVTVnQVZraUVCUG5RMEFjU0ROQUVMbERRQkVwUTBBWUtWTkFGMGxqUUJkcFkwQWEyV05BSG1salFCNjVZMEFmLVhOQUVEbURRQkNaZzBBU1NZTkFFM21EUUJRNWcwQVpTWU5BR2oBECxwWmcwQWJTWU5BRzQBECw0NWcwQWVlWU5BSDABEFg5cGcwQVE2Wk5BRVRtVFFCRnBrMEFSeQEQAHIBEBRTWmswQVUBEARGTwEQAFUBEBhXR1pOQUZvARD0VQNTM05CQVZOelFRRlljMEVCUXgxY0FvRWZYQUxfX1lnQ0owS3FBaWhDcWdMLWVLb0NSb21xQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQ2Y4MnFBblhhcWdKVi1Lb0NEUHFxQWliN3FnSkItNm9DQXhTckF1TWZxd0pVSUtzQ1hTR3JBandqcXdLRUo2c0NWQ2lyQWpZcnF3TDdLNnNDMURhckFpVTZxd0lwT3FzQ0xUcXJBcjAtcXdKRVFhc0Nya0dyQW14S3F3SmdUcXNDdUU2ckFoMVFxd0lmVUtzQzlGQ3JBZ0pScXdJS1Vhc0NJRnlyQXNObnF3SV9hcXNDR1hHckF2Qnhxd0pfYzZzQ3luU3JBaGQzcXdJYmQ2c0NJSGVyQWlWM3F3SXFkNnNDczNpckFnaDVxd0t5ZnFzQ1VvQ3JBa3FCcXdLY2dhc0NvWUdyQXNxQ3F3TERoS3NDVm9lckFuS0hxd0tmaXFzQ19JdXJBaFNNcXdLeGpLc0N0SXlyQWlXUXF3SmNrcXNDcUplckFsNmFxd0p4bjZzQ3VaLXJBbXlocXdLem9xc0NscVNyQXNta3F3S2NwcXNDRjZxckF0dXJxd0trcktzQ1FxNnJBanV2cXdMeHI2c0N4N0NyQXNleHF3SkFzcXNDU0xLckFtS3lxd0lQczZzQ1g3T3JBdTJ6cXdJV3RLc0NHclNyQWlHMHF3SWx0S3NDS2JTckFveTJxd0xMdHFzQzY3YXJBajYzcXdKUHQ2c0NYcmVyQW8yM3F3SzF0NnNDMHJlckF0MjNxd0lUdUtzQzVMaXJBaUc1cXdMNXVhc0NKcnFyQWpXNnF3Sjd1cXNDdUxxckFsaTdxd0lndktzQ1RyeXJBdVc4cXdMSXZhc0NsTzBGQTVwMEpBVEFkU1FFQlY3M0JFRmU5d1RZZDY0RmxYaXVCUTk2cmdWbmU2NEZtWHV1QlFkOHJnVkZ0TVVGMFlZakNsbTEteEw4eF9zU1pRNzhFajRWX0JKckZmd1M5QmY4RW5rWV9CTG5IZndTNlIzOEV2QWRfQklTSHZ3U0xCNzhFcUFlX0JMWkh2d1NZUl84RXM4Zl9CSmJuLW9VLUZackdySHdXU2hoaWVGWiZleGs9MbVazaUAY82l8NBDSWNaSEo0elNYdGE4VkIyZVpYMWFVUXRGZXFzRWZrTWJ3MGpwcjcteGFrRk1JQUhidzh6My1OT1g1YzhBYUp2U2k4SFpReHF3N2dWNU4xTDZSbHBXbVdZYlJkQ2lyVk4zTDBTQjBPYTRObWRad1ZBbWVEdDhXbkZ6c29helU5eGdSVVFjOEtZdm1Ga0MwR2R3bVpVYzlPdWstb2lBSDFJU01ELTliREJadXFFMWZ2OFJaY2VTMkJXcE8tTW5PTGVpeUx2a0omYXdiaWRfZD1BS-F69JAERDBUNEVBbWVySEdJUkd6am1vZFE4ZGVOZlNOQUh0M21lT3Y2RnZPS3dIQUJ5VjNyZDZmV1N3QzcyRGlGWFZtTDB6dzhnUmtGczBwYk14VmZ3ajJYTlZ6YmpVSTZ0ZVNPWTZTRG04ckQxT0JvcGc1dzVDUWFpU0t4Xzc4d2x3TFdWbDBBd3VtOHlUbWtqa0NnM0x0MWlxejBvbno1dks4OGxFajZ4T3lOZzh1YXBQa2tTNzlLcFB5S3QyM3JjX0xSWXBHV2tyZ2tZaFM5WXpyV3ZUeFp6THBLcmtTWGJyZnNwQ2IwSG8ycUNCcnhGcFFtNHl5bGctTGp5WmNsRFlyU2xad3VuSkhZQzhiYm4tUVpTbVNFb3dTdFhFTmtGYWxpMFFZN25tT0k5WVZrTUxNaFI1Q3FOM0s2NkFQZGpyb2pqSW9uOWdubHMwRm0wWXExSER6X041Nk5qdzJSRHFhT3BaRERoQkVTNXJ3QlZacE5lWnBmQ2N4MF9adEk1LVJqbk51cm5VNE5wNFlGZV80MmszT3lwUk52SG1BTFNqLVd0R0RDRHN0eXZzd2p0M3VPM1V2dE5aVWFCcnlQNmltaExQZW1jTGprMllmSU9LTzV0MWd3Mk1OR0w2NGhsZEpLYWFwLW5hWmNXZm1xSWZGQktUS0syVzl0QzZBTWZ1TElzcHVSRDJ6b1lVdEEyVG5adVhyanJwY1M3b0JyeE5tcjJoUEFnZjcxWEdQbkZ5dmxuXzl0OThlNVQ0NDFSQmtkeFhJal9DbnhIT19TLVBJNlZvcm13bXQxUXlWcUdIc0Y5ank0UHlLOVZLZXZBMWFVeWNsMTFHQ0dzRmItYlhtX1dvZzM1TFJjNUhObVk2WVpYS0JDRFQxY0xOdlk0ZHlCRE93N0FndW0zaUZZTnlRaGcyZlhTSU1TcVgtMEc2c1B2TjBzV01IUEFyZExMejlLSlpJU3hMbS1PME00MVNfZ2FHQWR1aEtHS0xIcFJrSjNob0FXVG9WRHZJUDF1cGlCUjhmMUZDUTVKY2RvSFRFU1JHcTM1VFRqVHNsRFdFQ0hDY1NneVZJdjBzcmxRN1JNazFfcWF4ZTRYV1ludjl4YkdraGF0RzUwWV8yTE45eGF6clduSVFwRHJjRm1fbWh4OXp1WUhRWjMxLVB6cUhKd2hON0wxMzdULUM5VFREcG9ueTc1VnRIY1hVNHRtNjJ2M0FWN1RVZ1U2bkFnSFVrdl9BYUxYWUZWZGc2UzdNX0tZcm9td3NIV3RLT1RXYjEtT3pJSlB0cS1YV3FWNUhtemFnUnhmMmNOel9Wc2JuZDc2S2Q3X3NfaG90ZG4zLUpxMFQzeGpGTlUyUFNHb1RTdzMwY0g0bXUtZEpELTFOdG91M09BOE9VVTFjMHcmY2lkPUNBUVNHd0F2SGhmXzIxSnVWQ3l5aGg0eTFVNU1pcUZNUDJBZ3c2WjhnUmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3ASpw5-MAzw10RSRTV0R3NoYjc3VEJrZzlXcVFZbzg4bFExRllPMjFvMm9BenlzVGtaQ2U2RnFqT3NHWWtUZTAyY0R5LTRseWJqQkhWck9hanpLWFZYWnhQcGw5RFJyR0gzb3UwQ0hrUFd2VGZNV2ZwOENNQWZrZGFvJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzYzOTMxNzMzODM0MTEyMzExNjkiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIECzg2Lh4bC_BtqAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBZ_ds57_gYSQRaoFKjhlMDdiZjIyLWUyMGQtNGI4NS1hOWI4LTgzYjY2YmJjOTk0YX43MTV-McAFAMkFAAAO_xkU8D_SBQkJAQoBATTYBQHgBQHwBdKVVvoFBAGIKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAbds4AYB8gYCCACABwGIBwCgBwGqBwwxNTgyMTI5NQ64DBzIB-ziBdIHDRV0ATUI2gcGAW2wGADgBwDqBwIIAPAH57EJiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=cff31e26a4f7a56f5869cabd2559c24df66ec18a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 519e50788224b3422c6e6b1cce48d5decb83eece248558b54e48f88491e48aa4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Expires: Thu, 14 Nov 2024 14:07:00 GMT
Date: Sun, 17 Dec 2023 04:21:31 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 2729670
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27680
X-Served-By: cache-lga21956-LGA, cache-yyz4559-YYZ
Last-Modified: Wed, 15 Nov 2023 14:06:46 GMT
Server: AkamaiNetStorage
X-Timer: S1702786892.917097,VS0,VE0
ETag: "ccac3ab7f323b8743d099010fcce15a4:1700057206.383562"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 34, 131093

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 9937 13 KB
5 KB 97ms
36ms Document
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lax1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 12785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 4767
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 00:48:26 GMT
etag: 12223946614886178233
expires: Mon, 18 Dec 2023 00:48:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame C59B 0
594 B 47ms
47ms Script
text/html 68.67.179.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.153 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:31 GMT
an-x-request-uuid: 5d69a2a7-9e09-47e8-b338-77b9bb077f56
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 86.48.15.79; 86.48.15.79; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame 8252 0
661 B 86ms
86ms Ping
text/html 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLoBvTZAmgDAAADANYABQEIy-75qwYQwdPVzZ2qx9xYGNSD3NWi4d3_bio2CS9xQKd8JCdAEZvG9lrQqyNAGQAAACCF6zpAIei_YmjQqyNAKajDCrd8JCdAMQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJDdkZjhhMmU2LTNmYjQtNDc1Ny1iMGM1LTc5ZWU3ZDEwODdhOdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA_wBCtQBaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLURSRTV0R3NoYjc3VEJrZzlXcVFZbzg4bFExRllPMjFvMm9BenlzVGtaQ2U2RnFqT3NHWWtUZTAyY0R5LTRseWJqQkhWck9hanpLWFZYWnhQcGw5RFJyR0gzb3UwQ0hrUFd2VGZNV2ZwOENNQWZrZGFvJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzYzOTMxNzMzODM0MTEyMzExNjkiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIECzg2LjQ4LjE1Ljc5qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBZ_ds57_gYSQRaoFKjhlMDdiZjIyLWUyMGQtNGI4NS1hOWI4LTgzYjY2YmJjOTk0YX43MTV-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdKVVvoFBAgAEACQBgCYBgC4BgDBBgBBhDAA8D_QBu6PAdoGFgoQBREdAbAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxNTgyMTI5NTkzMjnIB-ziBdIHDQkROAE1DNoHBggFCajgBwDqBwIIAPAH57EJiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=9fa057b3f8a071bb83783b9c0fff65ff02e957b7&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=6323762221949889622&vd=ct~0|rr~0&sv=240&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
an-x-request-uuid: aadb7487-a30d-47ed-a2f1-dbe15a2937f3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 86.48.15.79; 86.48.15.79; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 9937 144 KB
45 KB 220ms
219ms XHR
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a7e11e2e8d3d38ee45f0756bc3c66883b431b13ce4939be32c451c96e1be1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 17 Dec 2023 04:21:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45794
x-xss-protection: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3E26 45 KB
13 KB 32ms
32ms Script
text/html 23.60.5.157
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.5.157 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-5-157.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: cab11b871a5e3bcf764de44934a7988e1fe207debe9da39d1a3f0a7943291435

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 04:21:32 GMT
Content-Encoding: gzip
Last-Modified: Sat, 16 Dec 2023 07:07:10 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9941
Connection: keep-alive
Content-Length: 13200
Expires: Sun, 17 Dec 2023 07:07:13 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 3E26 7 B
861 B 206ms
37ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: f69a50991384d09413b97a37bb74928b
Expires: 0

GET
H2 200 d8c1a24f1ed02c29130d95542ba98781.js Show response
www.gstatic.com/mysidia/ Frame 9937 16 KB
7 KB 1113ms
37ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d8c1a24f1ed02c29130d95542ba98781.js?tag=client_fast_engine

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

ec75236f874497d40819be19b2ca82358918750ba3eac1873ab3ce7fd8576aba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:15:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 263176
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6614
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 13 Mar 2024 03:15:17 GMT

GET
H2 200 b36c97ad56710207b2644df4a775d1db.js Show response
www.gstatic.com/mysidia/ Frame 9937 15 KB
7 KB 1111ms
35ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b36c97ad56710207b2644df4a775d1db.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

812eac377efb90aef8a9c202533e44bf88df3d62c2c2298a68ff1c0196b7f11c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:38:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261763
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6329
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 13 Mar 2024 03:38:50 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9937 14 KB
1 KB 50ms
46ms Stylesheet
text/css 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 17 Dec 2023 04:21:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 17 Dec 2023 03:56:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 17 Dec 2023 04:21:32 GMT

GET
H2 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 9937 3 KB
1 KB 1149ms
41ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdbe9b84c30a00229826b0b1e354c94d36dd6bf16e6580bbef43877689c8f5bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 00:43:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13105
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1182
x-xss-protection: 0
server: cafe
etag: 16216481440669322801
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 31 Dec 2023 00:43:08 GMT

GET
H2 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 9937 31 KB
12 KB 1158ms
50ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 23:48:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16369
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 30 Dec 2023 23:48:44 GMT

GET
H2 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 9937 3 KB
1 KB 1148ms
40ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 19:03:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33489
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1307
x-xss-protection: 0
server: cafe
etag: 18393213423120915576
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 30 Dec 2023 19:03:24 GMT

GET
H2 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 9937 30 KB
12 KB 1143ms
36ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425c887bd8caee3ae355f251cb53649dd492f884523e1609ce4437ef70edc727

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 11:02:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62359
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11807
x-xss-protection: 0
server: cafe
etag: 2895842962934950836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 30 Dec 2023 11:02:14 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 9937 0
0 1154ms
48ms Image
text/html 142.251.16.104
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRio_JYv11m_4S7v64QE9WquNt9EqF3mOhJ5wBiOEPohQ1T6-c6D80OgBxiQBvwkf_6V6U4yuXv1eT0yf8O-dJRY3pNSQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.16.104 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f104.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9937 203 KB
65 KB 61ms
59ms Script
text/javascript 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f157.1e100.net

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 04:21:32 GMT

GET
H2 200 54d1c22c3cbefc4e5c3655ead0d764a5.js Show response
www.gstatic.com/mysidia/ Frame 9937 54 KB
20 KB 1121ms
50ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/54d1c22c3cbefc4e5c3655ead0d764a5.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

b496fae0bf22e95b2ff8eb5477cb418c118245ac7e9a042dc5bac4a59e7ec249

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 10:36:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20527
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 15 Mar 2024 10:36:03 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 3E26
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=LQ8ZCLX0-5-ACYN
https://ssc-cms.33across.com/ps/?xi=1&xu=LQ8ZCLX0-5-ACYN
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LQ8ZCLX0-5-ACYN&ts=1702786892&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

41ms
40ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LQ8ZCLX0-5-ACYN&ts=1702786892&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:32 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LQ8ZCLX0-5-ACYN&ts=1702786892&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3E26
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/QY-810vzZtz0KaNh6AHfsA?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-WyHB8CtE2oIaGa9bzTLAT.HHoxOVXKWOao24Rg--~A

42 B
927 B

38ms
37ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-WyHB8CtE2oIaGa9bzTLAT.HHoxOVXKWOao24Rg--~A
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Sun, 17 Dec 2023 04:21:32 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-WyHB8CtE2oIaGa9bzTLAT.HHoxOVXKWOao24Rg--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3E26
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJ3Git8hAMAYoVPAPsBCpnE&google_cver=1

42 B
927 B

101ms
35ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJ3Git8hAMAYoVPAPsBCpnE&google_cver=1
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 8bab65602db075726861004da5629947
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJ3Git8hAMAYoVPAPsBCpnE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3E26
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c550f4ca-ecd2-4be0-899e-54c85227a70a&gdpr=0&gdpr_consent=&expires=30

42 B
927 B

72ms
36ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c550f4ca-ecd2-4be0-899e-54c85227a70a&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c550f4ca-ecd2-4be0-899e-54c85227a70a&gdpr=0&gdpr_consent=&expires=30
date: Sun, 17 Dec 2023 04:21:32 GMT
server: Kestrel
content-length: 289

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 3E26
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ8ZCLX0-5-ACYN

0
515 B

3224ms
124ms

Image
text/plain

13.107.42.14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ8ZCLX0-5-ACYN
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 13.107.42.14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:35 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 61FA6BFF499944A18A1CE19AF6EB904F Ref B: YTO01EDGE0808 Ref C: 2023-12-17T04:21:35Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYMrPgL0KSAL7PD8evBQA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ8ZCLX0-5-ACYN
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 5e07703167439847c6c49a939083c0fd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 3E26
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=emTk_5VUQg2OHfFIqOAwlw&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=emTk_5VUQg2OHfFIqOAwlw

43 B
479 B

42ms
42ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=emTk_5VUQg2OHfFIqOAwlw

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:34 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JWPRSK6K2SE4RXEYYE60
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=emTk_5VUQg2OHfFIqOAwlw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 3E26
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=LQ8ZCLX0-5-ACYN&ex=d-rubiconproject.com&status=ok

43 B
479 B

1667ms
37ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LQ8ZCLX0-5-ACYN&ex=d-rubiconproject.com&status=ok

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:34 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: MA74BKTJFQVN39086FNY
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LQ8ZCLX0-5-ACYN&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E26
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFE4WkNMWDAtNS1BQ1lO
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEIKKvO-p61eC46klgoL85fc&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFE4WkNMWDAtNS1BQ1lO&google_push=

170 B
188 B

47ms
47ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFE4WkNMWDAtNS1BQ1lO&google_push=

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFE4WkNMWDAtNS1BQ1lO&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E26
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OTU1ZWQxMTlhM2JjNGVkZmVkNTYxYmE2ZmUxYjU3NzA5MDA2Y2JkNQ

170 B
188 B

48ms
48ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OTU1ZWQxMTlhM2JjNGVkZmVkNTYxYmE2ZmUxYjU3NzA5MDA2Y2JkNQ

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-156-40-244.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OTU1ZWQxMTlhM2JjNGVkZmVkNTYxYmE2ZmUxYjU3NzA5MDA2Y2JkNQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 3E26
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=YCCTYTmURvibly3GXOU5nw&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=YCCTYTmURvibly3GXOU5nw

43 B
479 B

113ms
113ms

Image
image/gif

52.94.223.167
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=YCCTYTmURvibly3GXOU5nw

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Server

52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:33 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 1WZA1G6FPXQQGYKC8DCC
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=YCCTYTmURvibly3GXOU5nw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK rp
match.prod.bidr.io/cookie-sync/ Frame 3E26 43 B
433 B 162ms
36ms Image
image/gif 54.156.40.244
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.156.40.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:32 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 3E26
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn
https://ce.lijit.com/merge?pid=80&3pid=LQ8ZCLX0-5-ACYN

43 B
663 B

1125ms
34ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LQ8ZCLX0-5-ACYN
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 04:21:33 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LQ8ZCLX0-5-ACYN
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Expires: 0

GET
H2

200

pixel
capi.connatix.com/us/ Frame 3E26
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=LQ8ZCLX0-5-ACYN&pId=11&gdpr=&gdpr_consent=&us_privacy=
https://capi.connatix.com/us/pixel?puid=LQ8ZCLX0-5-ACYN&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true

82 B
82 B

60ms
59ms

Image
image/gif

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=LQ8ZCLX0-5-ACYN&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 836c61415959a210-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sun, 17 Dec 2023 04:21:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://capi.connatix.com/us/pixel?puid=LQ8ZCLX0-5-ACYN&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 836c6140f8e2a210-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3E26
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ8ZCLX0-5-ACYN

68 B
279 B

37ms
36ms

Image
image/png

3.213.124.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ8ZCLX0-5-ACYN
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 3.213.124.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-124-140.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:32 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ8ZCLX0-5-ACYN
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Expires: 0

GET
H3

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 3E26
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LQ8ZCLX0-5-ACYN
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ8ZCLX0-5-ACYN

43 B
884 B

54ms
54ms

Image
image/gif

13.224.214.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ8ZCLX0-5-ACYN
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H3
Server: 13.224.214.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-10.phl50.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:33 GMT
via: 1.1 235099561ba63a2b7662a2b20d9ac036.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: B90hX2H_gPBy_voq4Q48UFJXRt2hWj9MdJd30d_v1R-Hx9O4XFZU8Q==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
via: 1.1 1f53e7c3ff322fe2a87e3b0e12a1a5b8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: PHL50-C1
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ8ZCLX0-5-ACYN
content-type: text/html; charset=utf-8
cache-control: no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: hWZFa3pg3DGCPRj5oRP3792u-FK8RLRKZf16QFNdaMhQexsBoID8hA==

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 3E26
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://prebid.a-mo.net/setuid/magnite?uid=LQ8ZCLX0-5-ACYN

0
450 B

361ms
33ms

Image
text/plain

147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LQ8ZCLX0-5-ACYN
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:32 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LQ8ZCLX0-5-ACYN
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e71ccbe96f42d70fa40603ada4c96b28
Expires: 0

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame 3E26
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LQ8ZCLX0-5-ACYN
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=LQ8ZCLX0-5-ACYN

95 B
429 B

54ms
53ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=LQ8ZCLX0-5-ACYN

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:33 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Sun, 17 Dec 2023 04:21:33 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=LQ8ZCLX0-5-ACYN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dcl.htm Show response
rt3041.infolinks.com/action/ 0
39 B 108ms
108ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3041.infolinks.com/action/dcl.htm?rid=8e07bf22-e20d-4b85-a9b8-83b66bbc994a&prod_t=d&sdata=article&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 836c613e2f1b39fa-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame C59B 0
593 B 74ms
74ms Script
text/html 68.67.179.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.153 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:32 GMT
an-x-request-uuid: 2e2d1911-43eb-4593-ab70-dd3401bfe694
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 86.48.15.79; 86.48.15.79; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame 8252 0
661 B 86ms
85ms Ping
text/html 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLoBvTZAmgDAAADANYABQEIy-75qwYQwdPVzZ2qx9xYGNSD3NWi4d3_bio2CS9xQKd8JCdAEZvG9lrQqyNAGQAAACCF6zpAIei_YmjQqyNAKajDCrd8JCdAMQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHjs4gWAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJDdkZjhhMmU2LTNmYjQtNDc1Ny1iMGM1LTc5ZWU3ZDEwODdhOdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA_wBCtQBaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLURSRTV0R3NoYjc3VEJrZzlXcVFZbzg4bFExRllPMjFvMm9BenlzVGtaQ2U2RnFqT3NHWWtUZTAyY0R5LTRseWJqQkhWck9hanpLWFZYWnhQcGw5RFJyR0gzb3UwQ0hrUFd2VGZNV2ZwOENNQWZrZGFvJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzYzOTMxNzMzODM0MTEyMzExNjkiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIECzg2LjQ4LjE1Ljc5qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBZ_ds57_gYSQRaoFKjhlMDdiZjIyLWUyMGQtNGI4NS1hOWI4LTgzYjY2YmJjOTk0YX43MTV-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdKVVvoFBAgAEACQBgCYBgC4BgDBBgBBhDAA8D_QBu6PAdoGFgoQBREdAbAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxNTgyMTI5NTkzMjnIB-ziBdIHDQkROAE1DNoHBggFCajgBwDqBwIIAPAH57EJiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=9fa057b3f8a071bb83783b9c0fff65ff02e957b7&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=6323762221949889622&vd=ct~0|rr~5&sv=240&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 04:21:33 GMT
an-x-request-uuid: 141e330b-2364-4ad7-9871-1002ac49a2d4
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 86.48.15.79; 86.48.15.79; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7590 143 B
166 B 36ms
36ms Document
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2980
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 03:31:53 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9937 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee475e9912262597924a560698ed428d739ee6a81f73ff8334a7ab44206844f1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9937
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CSv8uS3d-ZfuOCM6Pur8Pj_yU-AvUh5CLdJiYhseyEmQQASDml9YlYP3QjIHoA6ABxMfulAHIAQGoAwHIA8sEqgThAU_QoaGBtu-8nZEpP8wH-bGe7s7jsA_g1HEHph3f0zUrYuenTq2OZnq...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x8291d3a284dcc8b00000000000000000%22,%222%22:%220xfb5f05e63ee7a8b50000000000000000%22,%223%22:%220x6b50f5...

0
0

121ms
49ms

Fetch
text/css

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x8291d3a284dcc8b00000000000000000%22,%222%22:%220xfb5f05e63ee7a8b50000000000000000%22,%223%22:%220x6b50f5f98e3b00880000000000000000%22,%224%22:%220xc7e3a9d7b3ca63b20000000000000000%22,%225%22:%220x80a68c7a96ba1a1a0000000000000000%22},%22debug_key%22:%221811988507340951725%22,%22debug_reporting%22:true,%22destination%22:%22https://getfreecoupons.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22312189892%22],%2222%22:[%22true%22],%224%22:[%2212-17%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214939703239462512609%22}&andc=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:21:34 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x8291d3a284dcc8b00000000000000000","2":"0xfb5f05e63ee7a8b50000000000000000","3":"0x6b50f5f98e3b00880000000000000000","4":"0xc7e3a9d7b3ca63b20000000000000000","5":"0x80a68c7a96ba1a1a0000000000000000"},"debug_key":"1811988507340951725","debug_reporting":true,"destination":"https://getfreecoupons.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["312189892"],"22":["true"],"4":["12-17"],"6":["true"]},"priority":"500","source_event_id":"14939703239462512609"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 04:21:34 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 17 Dec 2023 04:21:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x8291d3a284dcc8b00000000000000000","2":"0xfb5f05e63ee7a8b50000000000000000","3":"0x6b50f5f98e3b00880000000000000000","4":"0xc7e3a9d7b3ca63b20000000000000000","5":"0x80a68c7a96ba1a1a0000000000000000"},"debug_key":"1811988507340951725","debug_reporting":true,"destination":"https://getfreecoupons.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["312189892"],"22":["true"],"4":["12-17"],"6":["true"]},"priority":"500","source_event_id":"14939703239462512609"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 9937 33 KB
34 KB 109ms
36ms Font
font/woff2 172.253.63.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f94.1e100.net

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 00:53:29 GMT
x-content-type-options: nosniff
age: 185284
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 00:53:29 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7590
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

46ms
45ms

Document
text/html

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS