anyfile-notepad.semaan.ca Open in urlscan Pro
45.79.39.170 Public Scan

Software

sffe /

Resource Hash

d9139d893d8ce76cd9f7b387262a669ced0270373637ba947037c770faef910d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 17 Nov 2023 15:38:05 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7116
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "a00202bbb14b751a"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Nov 2023 15:38:05 GMT

GET
H2 200 client Show response
accounts.google.com/gsi/ 199 KB
79 KB 142ms
68ms Script
application/javascript 142.251.163.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/client

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f84.1e100.net

Software

ESF /

Resource Hash

bc39dff012d2c5ada9c437c4defb46a0c77a04801804664bdb8d1f6a7996bcc5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-wabc0B3mYLimWtKtZ0oEIA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-security-policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-wabc0B3mYLimWtKtZ0oEIA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Fri, 17 Nov 2023 15:38:06 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 110ms
36ms Script
text/javascript 142.250.31.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 17 Nov 2023 14:59:40 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2306
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 17 Nov 2023 16:59:40 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/ 429 KB
135 KB 117ms
35ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b04dfae5d49297b8b6a514bd8bf1c7bea7ebe622232401a5abed5a92809a2b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 17 Nov 2023 00:24:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54811
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137535
x-xss-protection: 0
server: cafe
etag: 18342593356503948095
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 16 Nov 2024 00:24:35 GMT

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
203 B 103ms
30ms XHR
text/plain 198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.contextweb.com/header/ortb?src=prebid

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-expose-headers: Access-Control-Allow-Origin
strict-transport-security: max-age=15768000
access-control-allow-credentials: true
x-no-bid-reason: Passback by decision

POST
H2 200 / Show response
prebid.admedia.com/bidder/ 322 B
327 B 121ms
35ms XHR
application/json 173.198.200.125
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.admedia.com/bidder/
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.198.200.125 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: 173-198-200-125.static.as40244.net
Software: nginx /
Resource Hash: a1e50719a968ea53edbc079f52b7c11dd246df4313372fd7a584d50bc04a568c

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
content-encoding: gzip
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, private
access-control-allow-credentials: true
expires: 0

POST
H/1.1 200
OK prebid Show response
lockerdome.com/ladbid/ 11 B
345 B 210ms
53ms XHR
application/json 104.154.142.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/ladbid/prebid
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Date: Fri, 17 Nov 2023 15:38:06 GMT
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 31
Content-Type: application/json; charset=utf-8

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1895.006-3.034/ 187 KB
57 KB 41ms
41ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54eacec863498628814d62c486eca8cd1c580c77a4dda865b5941006e40c6e66

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 4386
etag: W/"2ede2-6099387db510d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82790f0d69d4a21d-YYZ
expires: Sun, 17 Dec 2023 14:25:00 GMT

POST
H2 200 stats Show response
api.anyfile-notepad.semaan.ca/ 2 B
235 B 146ms
19ms XHR
text/plain 159.89.121.194
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://api.anyfile-notepad.semaan.ca/stats
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.121.194 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv.semaan.ca
Software: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: */*
Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 17 Nov 2023 15:38:06 GMT
server: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5
access-control-allow-headers: Content-Type, Authorization
content-length: 2
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/plain; charset=utf-8

GET
H2 200 Lato-Regular.ttf
anyfile-notepad.semaan.ca/fonts/ 593 KB
594 KB 52ms
52ms Font
font/ttf 45.79.39.170
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Lato-Regular.ttf
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.79.39.170 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 45-79-39-170.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 089ab6d4a57e0e6c4dd3b681b6fd50a5184f1b902429d35e1227e52d6ccad1bd

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
x-afn-server: afn-srv-v2-dal-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/ttf
access-control-allow-origin: *
accept-ranges: bytes
content-length: 607720

GET
H2 200 Material-Design-Icons.woff
anyfile-notepad.semaan.ca/fonts/ 100 KB
100 KB 53ms
52ms Font
font/woff 45.79.39.170
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Material-Design-Icons.woff?3ocs8m
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.79.39.170 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 45-79-39-170.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: be00e19b662046cb8f2eb6eb86e4689edeefb0c003f6a215df9c22f0e15e16ad

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
x-afn-server: afn-srv-v2-dal-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/woff
access-control-allow-origin: *
accept-ranges: bytes
content-length: 101968

GET
H2 200 logo.png
anyfile-notepad.semaan.ca/ 6 KB
6 KB 133ms
133ms Image
image/png 45.79.39.170
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://anyfile-notepad.semaan.ca/logo.png
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.79.39.170 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 45-79-39-170.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: bfb6a8799c9f3a60f0a04e2cc9c1d9df6c591708ae4aaa3eda711fcde2d31df9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
x-afn-server: afn-srv-v2-dal-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
content-length: 6277

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ 316 KB
108 KB 38ms
37ms Script
text/javascript 142.251.16.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3253ebd8d1a3c41f020b8e18e84bf61b96b0c1bba646b047fa90d87e72438371

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 02:59:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 131912
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110396
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Nov 2024 02:59:34 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
227 B 44ms
43ms XHR
text/plain 142.250.31.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2016808864&t=pageview&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&ul=en-us&de=UTF-8&dt=Anyfile%20Notepad&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=2065200354&gjid=1584345018&cid=1411481306.1700235486&tid=UA-69003440-1&_gid=2083031702.1700235486&_r=1&_slc=1&z=1213317479

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

a59d6fec09f986c957c8192fbd71a84cc53315793fb9cde7de010e6a0cfccaea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame 5590 11 KB
2 KB 55ms
52ms Document
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1a5681597123ebf7d84c9cfccba20808af216d0aa89e4912f0c4c7ade327dbb

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 82790f0e4ad0a21d-YYZ
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 17 Nov 2023 15:38:06 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 282 B
303 B 55ms
55ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f341215f6f88cdc63300c5fd2b795e6425454f0469b8915d23f91b09273ba9dc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript;charset=ISO-8859-1
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 82790f0e4ad5a21d-YYZ

GET
H2 200 gsd Show response
router.infolinks.com/ 319 B
489 B 57ms
56ms Script
text/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&jsv=1895.006-3.034&_cb=17002354864350
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8fa28100f715f3915144c9a37f27dc0583ab512c5fff780923671ebbb7c7b520

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/javascript;charset=UTF-8
p3p: CP="NON DSP NID OUR COR"
cache-control: max-age=0
cf-ray: 82790f0e4ad8a21d-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
81 KB 125ms
54ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

1155efb8c9da0329cede14312c44920f13707c42a5488a15746b0291c4893c75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82686
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 17 Nov 2023 15:38:06 GMT

GET
H2 200 proxy.html Show response
content.googleapis.com/static/ Frame 8A58 382 B
1 KB 112ms
37ms Document
text/html 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebc2eaa1e43acb9052a6654606d2819fbdda88b90cd52d1510a85f411ae5486c

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-FcscNvo4TbaEDyJH-vFVQw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 272
content-security-policy: script-src 'nonce-FcscNvo4TbaEDyJH-vFVQw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
content-type: text/html
cross-origin-embedder-policy: require-corp; report-to="apiserving"
cross-origin-opener-policy-report-only: same-origin; report-to="apiserving"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
pragma: no-cache
report-to: {"group":"apiserving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apiserving"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 130 KB
48 KB 328ms
328ms Fetch
text/plain 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1269844086578209&correlator=4039105192687025&eid=31077978%2C31078986%2C31079657%2C31079527%2C31078659&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fif&iu_parts=61772569%2Cdbmtiqbxqoopp7t3s9lq_anyfilenotepadsemaanca_160x600_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1700235486555&lmt=1690678352&adxs=1440&adys=65&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&bz=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&vis=1&psz=0x-1&msz=160x-1&fws=644&ohw=1600&ga_vid=1411481306.1700235486&ga_sid=1700235487&ga_hid=2016808864&ga_fc=true&dlt=1700235485729&idt=519&adks=450036033&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52c4fc3aa9cac221139539554296d1571727e80205b4264f2e3914dcb2c5c795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48631
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame ED39 6 KB
3 KB 119ms
37ms Document
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: Sat, 16 Nov 2024 15:38:06 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 60F8
Redirect Chain

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

1 KB
2 KB

34ms
30ms

Document
text/html

67.202.105.33
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.33 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip33.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 40f8b3cfcee3fde4bcb5cc41e032e67614160a04ff55030dede42d77c407a94c

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1403
content-type: text/html
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 0
date: Fri, 17 Nov 2023 15:38:05 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame E285
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

1 KB
817 B

59ms
59ms

Document
text/html

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ab8c68e12816592d7ca385c6b6cb0f780c770ff167997418ff3e3a3f9ed4718

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 82790f0fc84236bc-YYZ
content-encoding: br
content-type: text/html
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZjqYXIihSbNr04Oe1RJNDogGiu7w2zuk4DsxMOaCbxoHQ5ExN4pbmPgk0TjO3CTABYGhqVu2V47tQFE6o1x8JtC1yqVw7vDF4IaqhEaj1SCWAZsvyEFKvBb0XembDG5vu8WLrVk1%2Bho0Mg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 82790f0f8fbd36bc-YYZ
content-length: 0
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=STksH9Q%2FVUuYQowYy4fgaCxvVCf%2B3PM2tRwVZ5BRoeWVrwv610h9s5QuPXnXA0QuC2dBuWVpZvT3ghDkUmFQKWrsBGiYMOnfw7as7hrGncm5mRUf13b6bGBwVwpmWozpYRID0nE7jYxL2g%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame F1EC 4 KB
2 KB 109ms
36ms Document
text/html 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

b0abaa760dffcb30e752c07c0615a0821e98feb72b9296e13b04c366e599ec72

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1410
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 5590
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTZDNDMwMTQtRTkzOS00NjJCLTk4NDAtRkQ2MjUyNjQ4NzIz&gdpr=-1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTZDNDMwMTQtRTkzOS00NjJCLTk4NDAtRkQ2MjUyNjQ4NzIz&gdpr=-1&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D96C43014-E939-462B-9840-FD6252648723&us_privacy=%24%7BUS_PRIVACY%7D
https://router.infolinks.com/dyn/pbm-usync?uid=96C43014-E939-462B-9840-FD6252648723
https://pixel.tapad.com/idsync/ex/receive?partner_id=3356&partner_device_id=96C43014-E939-462B-9840-FD6252648723
https://dpm.demdex.net/ibs:dpid=540&dpuuid=6f8959c5-e976-46b0-b6ef-904e97900d6b&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=540&dpuuid=6f8959c5-e976-46b0-b6ef-904e97900d6b&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=33460457867507979001056177234061602553&pt=6f8959c5-e976-46b0-b6ef-904e97900d6b%2C%2C

95 B
124 B

53ms
53ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=33460457867507979001056177234061602553&pt=6f8959c5-e976-46b0-b6ef-904e97900d6b%2C%2C

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:09 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

dcs: dcs-prod-va6-1-v053-0740ee61b.edge-va6.demdex.com 3 ms
pragma: no-cache
date: Fri, 17 Nov 2023 15:38:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: AK49E+B5Qto=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=33460457867507979001056177234061602553&pt=6f8959c5-e976-46b0-b6ef-904e97900d6b%2C%2C
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

apn-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID
https://router.infolinks.com/dyn/apn-usync?user_id=6970583706083711862

35 B
195 B

56ms
52ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/apn-usync?user_id=6970583706083711862
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f103d34a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
an-x-request-uuid: 61139cc4-232e-4eb3-9ee3-0132b2b9f02c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://router.infolinks.com/dyn/apn-usync?user_id=6970583706083711862
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

iqm-us
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://pxl.iqm.com/i/ck/infolink?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fiqm-us%3Fuid%3D%7BIQM_COOKIE%7D%20
https://router.infolinks.com/dyn/iqm-us?uid=0d58827c-067f-4551-a288-d23885f62fce

35 B
193 B

59ms
59ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/iqm-us?uid=0d58827c-067f-4551-a288-d23885f62fce
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f100cf5a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

date: Fri, 17 Nov 2023 15:38:06 GMT
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/avif;charset=UTF-8
location: https://router.infolinks.com/dyn/iqm-us?uid=0d58827c-067f-4551-a288-d23885f62fce
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 81

GET
H2

200

eqv-us
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=112&gdpr=0&gdpr_consent=
https://router.infolinks.com/dyn/eqv-us?user_id=315942424790739550&gdpr=0&gdpr_consent=

35 B
186 B

58ms
57ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/eqv-us?user_id=315942424790739550&gdpr=0&gdpr_consent=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f102d1ba21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

location: https://router.infolinks.com/dyn/eqv-us?user_id=315942424790739550&gdpr=0&gdpr_consent=
date: Fri, 17 Nov 2023 15:38:06 GMT
content-length: 0

GET
H2

200

ox-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://u.openx.net/w/1.0/cm?cc=1&id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://router.infolinks.com/dyn/ox-usync?uid=827269dd-e801-4250-8a98-8a9a1729ccbe

35 B
199 B

54ms
54ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ox-usync?uid=827269dd-e801-4250-8a98-8a9a1729ccbe
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f100cf9a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://router.infolinks.com/dyn/ox-usync?uid=827269dd-e801-4250-8a98-8a9a1729ccbe
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 5590
Redirect Chain

https://ups.analytics.yahoo.com/ups/58786/sync?redir=true
https://ups.analytics.yahoo.com/ups/58786/sync?redir=true&verify=true
https://router.infolinks.com/dyn/VR-usync?uid=y-Las5ueVE2uJI91bkPmj2b07Sh4LJNcsR~A
https://pixel.tapad.com/idsync/ex/receive?partner_id=3399&partner_device_id=y-Las5ueVE2uJI91bkPmj2b07Sh4LJNcsR~A
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3399&partner_device_id=y-Las5ueVE2uJI91bkPmj2b07Sh4LJNcsR~A
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=3e94d12b-d11f-4e26-97ee-a1dae25c8a13%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c522ed6f-4218-494d-9ed7-6f4d15b0c678&ttd_puid=3e94d12b-d11f-4e26-97ee-a1dae25c8a13%2C%2C

95 B
124 B

53ms
52ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c522ed6f-4218-494d-9ed7-6f4d15b0c678&ttd_puid=3e94d12b-d11f-4e26-97ee-a1dae25c8a13%2C%2C

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:07 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c522ed6f-4218-494d-9ed7-6f4d15b0c678&ttd_puid=3e94d12b-d11f-4e26-97ee-a1dae25c8a13%2C%2C
date: Fri, 17 Nov 2023 15:38:07 GMT
server: Kestrel
content-length: 359

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://sync.1rx.io/usersync2/infolinks
https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1700235486728
https://ad.turn.com/r/cs?pid=45&rndcb=5224019680
https://sync.1rx.io/usersync/turn/4555342631578414177?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005

35 B
250 B

53ms
52ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:10 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f272a1aa21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:10 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
Date: Fri, 17 Nov 2023 15:38:10 GMT
Content-Type: text/html
Connection: keep-alive
ETag: RXf3acbfb2cb564e6187235561ebafd99e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H2

200

zmn-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__&s=2
https://router.infolinks.com/dyn/zmn-usync?uid=bgDgZa3s-CMdJGJmyKWf

35 B
190 B

65ms
61ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zmn-usync?uid=bgDgZa3s-CMdJGJmyKWf
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f103d39a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:06 GMT
Content-Type: text/html; charset=utf-8
Location: https://router.infolinks.com/dyn/zmn-usync?uid=bgDgZa3s-CMdJGJmyKWf
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 90
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

tplift
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://router.infolinks.com/dyn/tplift?uid=4667789459507755246099

35 B
247 B

62ms
58ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/tplift?uid=4667789459507755246099
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f103d3ba21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

location: https://router.infolinks.com/dyn/tplift?uid=4667789459507755246099
date: Fri, 17 Nov 2023 15:38:06 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sonobi-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
https://router.infolinks.com/dyn/sonobi-usync?uid=ce8807c4-af98-4ef3-9b38-633179cb1735

35 B
258 B

52ms
51ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sonobi-usync?uid=ce8807c4-af98-4ef3-9b38-633179cb1735
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f0ffcc3a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-69
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://router.infolinks.com/dyn/sonobi-usync?uid=ce8807c4-af98-4ef3-9b38-633179cb1735
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET server_match
ad.360yield.com/ Frame 5590 0
0

GET
H2

200

outh-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://router.infolinks.com/dyn/outh-usync?uid=y-70qdOvFE2uFzBFDpOrH15UI3bQHTxe2G~A

35 B
205 B

59ms
58ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/outh-usync?uid=y-70qdOvFE2uFzBFDpOrH15UI3bQHTxe2G~A
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f10edffa21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

location: https://router.infolinks.com/dyn/outh-usync?uid=y-70qdOvFE2uFzBFDpOrH15UI3bQHTxe2G~A
date: Fri, 17 Nov 2023 15:38:06 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sovrn-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
https://router.infolinks.com/dyn/sovrn-usync?uid=HrAqeLZHMgxTnv_gRZKokQMx

35 B
196 B

58ms
56ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sovrn-usync?uid=HrAqeLZHMgxTnv_gRZKokQMx
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f3e1f15a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:14 GMT

Redirect headers

Date: Fri, 17 Nov 2023 15:38:14 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://router.infolinks.com/dyn/sovrn-usync?uid=HrAqeLZHMgxTnv_gRZKokQMx
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

usersync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://image4.pubmatic.com/AdServer/SPug?p=60809&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fusersync%3Fpmuservalue%3D96C43014-E939-462B-9840-FD6252648723
https://router.infolinks.com/dyn/usersync?pmuservalue=96C43014-E939-462B-9840-FD6252648723

0
155 B

54ms
54ms

Image
text/plain

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/usersync?pmuservalue=96C43014-E939-462B-9840-FD6252648723
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:08 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 82790f1a191ba21d-YYZ
content-length: 0

Redirect headers

location: https://router.infolinks.com/dyn/usersync?pmuservalue=96C43014-E939-462B-9840-FD6252648723
date: Fri, 17 Nov 2023 15:38:07 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

mnet-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://cs.media.net/cksync?cs=41&ovsid=setstatuscode&type=inf&redirect=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmnet-usync%3Fuid%3D%3Cvsid%3E
https://router.infolinks.com/dyn/mnet-usync?uid=3432370875655312000V10

35 B
264 B

56ms
55ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mnet-usync?uid=3432370875655312000V10
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f186f4da21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:08 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:07 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://router.infolinks.com/dyn/mnet-usync?uid=3432370875655312000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Fri, 17 Nov 2023 15:38:07 GMT

GET
H2

200

mgid-us
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://cm-x.mgid.com/5abf3d2eff2f70c0a0669cd9f0f84ba0.gif?puid=[UID]&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmgid-us%3Fuser_id%3D%5BUID%5D
https://router.infolinks.com/dyn/mgid-us?user_id=c1fb2370-d370-47c5-9428-c3eef505bd24

35 B
255 B

56ms
56ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mgid-us?user_id=c1fb2370-d370-47c5-9428-c3eef505bd24
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f116e9ca21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:06 GMT
Transfer-Encoding: chunked
Location: https://router.infolinks.com/dyn/mgid-us?user_id=c1fb2370-d370-47c5-9428-c3eef505bd24
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=5
Expires: 0

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=infolinks
https://ad.turn.com/r/cs?pid=45&rndcb=5570961936
https://sync.1rx.io/usersync/turn/4483285037540486241?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005

35 B
92 B

55ms
55ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:10 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f275a55a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:10 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
Date: Fri, 17 Nov 2023 15:38:10 GMT
Content-Type: text/html
Connection: keep-alive
ETag: RXf3acbfb2cb564e6187235561ebafd99e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H2

200

qc-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://cms.quantserve.com/pixel/p-u1vdacBMXAcfT.gif?idmatch=0
https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=smBPS7xtH0qpZEodtWRXTeYwS0qpYR9M4TPrIbcj

35 B
213 B

63ms
62ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=smBPS7xtH0qpZEodtWRXTeYwS0qpYR9M4TPrIbcj
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f3e1f19a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:14 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=smBPS7xtH0qpZEodtWRXTeYwS0qpYR9M4TPrIbcj
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

zeta-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://p.rfihub.com/cm?pub=43153&in=1
https://router.infolinks.com/dyn/zeta-usync?uid=1797288127615694379

35 B
200 B

60ms
59ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zeta-usync?uid=1797288127615694379
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f19f8f8a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:08 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/zeta-usync?uid=1797288127615694379
Date: Fri, 17 Nov 2023 15:38:08 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

disus
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fdisus%3Fuid%3D%24UID&partner=infolinks
https://sync.go.sonobi.com/us?gdpr=&gdpr_consent=&us_privacy=&loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS0yNWQ5MDRhOS02MTQ5LTMxMzgtODBkZS04ZDVmMDJlZDQ...
https://ssp.disqus.com/match?bidder=18&buyeruid=ce8807c4-af98-4ef3-9b38-633179cb1735&r=Cid1YS0yNWQ5MDRhOS02MTQ5LTMxMzgtODBkZS04ZDVmMDJlZDQ1NDQQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS...
https://us.ck-ie.com/ztg897.gif?gdpr=&gdpr_consent=&us_privacy=&coppa={$COPPA}&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D30%26buyeruid%3D%7B%24PARTNER_UID%7D%26r%3DCid1YS0yNWQ5MDRhOS02M...
https://ssp.disqus.com/match?bidder=30&buyeruid=80dafdfe0b4b3f11009312688a389d9f9b62421fd659e66c04d85e1eb252e83c&r=Cid1YS0yNWQ5MDRhOS02MTQ5LTMxMzgtODBkZS04ZDVmMDJlZDQ1NDQQ____________ASpSaHR0cHM6Ly...
https://router.infolinks.com/dyn/disus?uid=ua-25d904a9-6149-3138-80de-8d5f02ed4544

35 B
280 B

57ms
57ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/disus?uid=ua-25d904a9-6149-3138-80de-8d5f02ed4544
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:09 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f227b81a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:09 GMT

Redirect headers

location: https://router.infolinks.com/dyn/disus?uid=ua-25d904a9-6149-3138-80de-8d5f02ed4544
pragma: no-cache
date: Fri, 17 Nov 2023 15:38:09 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

33a-usync
router.infolinks.com/dyn/ Frame 5590
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
https://router.infolinks.com/dyn/33a-usync?uid=212348229273181

35 B
192 B

59ms
59ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/33a-usync?uid=212348229273181
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f146a6ea21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:07 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
referrer-policy: unsafe-url
server: 33XP006
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://router.infolinks.com/dyn/33a-usync?uid=212348229273181
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 5590
Redirect Chain

https://router.infolinks.com/dyn/iq-usync
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=f70e2aa5-7678-435b-8f20-bcd095ce481a&3rddpi=2023874098&3rdpcid=ZVeI3rn5NE-liTNwhcDopAAA%261302&3rddpi...

43 B
977 B

40ms
39ms

Image
image/gif

52.85.132.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=f70e2aa5-7678-435b-8f20-bcd095ce481a&3rddpi=2023874098&3rdpcid=ZVeI3rn5NE-liTNwhcDopAAA%261302&3rddpi=1810047279&3rdpcid=0d58827c-067f-4551-a288-d23885f62fce&3rddpi=1639354730&3rdpcid=y-70qdOvFE2uFzBFDpOrH15UI3bQHTxe2G%7EA&3rddpi=445262707&3rdpcid=7EVrCce6PtJ2bfkfPZJuDYQU14mZWR76XUkvyRJ_hI8&3rddpi=1634346717&3rdpcid=bgDgZa3s-CMdJGJmyKWf&3rddpi=1213503647&3rdpcid=y-Las5ueVE2uJI91bkPmj2b07Sh4LJNcsR%7EA&3rddpi=1541423991&3rdpcid=212348229273181&3rddpi=1239766150&3rdpcid=827269dd-e801-4250-8a98-8a9a1729ccbe
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 52.85.132.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-132-68.iad50.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: vm4bKmnfdc8r-Wcu7llEjEuAWE6WQj1HIgNVbfDTANwW3nRfn6rWIQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Fri, 17 Nov 2023 15:38:07 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=f70e2aa5-7678-435b-8f20-bcd095ce481a&3rddpi=2023874098&3rdpcid=ZVeI3rn5NE-liTNwhcDopAAA%261302&3rddpi=1810047279&3rdpcid=0d58827c-067f-4551-a288-d23885f62fce&3rddpi=1639354730&3rdpcid=y-70qdOvFE2uFzBFDpOrH15UI3bQHTxe2G%7EA&3rddpi=445262707&3rdpcid=7EVrCce6PtJ2bfkfPZJuDYQU14mZWR76XUkvyRJ_hI8&3rddpi=1634346717&3rdpcid=bgDgZa3s-CMdJGJmyKWf&3rddpi=1213503647&3rdpcid=y-Las5ueVE2uJI91bkPmj2b07Sh4LJNcsR%7EA&3rddpi=1541423991&3rdpcid=212348229273181&3rddpi=1239766150&3rdpcid=827269dd-e801-4250-8a98-8a9a1729ccbe
cache-control: no-store
cf-ray: 82790f14cae5a21d-YYZ
content-length: 0

GET
H2 200 iqusync-1.25.min.js Show response
resources.infolinks.com/static/usync/ 2 KB
1 KB 35ms
35ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e035885f253b73836d41088415cc8c467e43385ca3452b111431e6ab76f990b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 22 May 2023 09:55:02 GMT
server: cloudflare
age: 1162
etag: W/"8e7-5fc4543bc811d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82790f0f5c02a21d-YYZ
expires: Sun, 17 Dec 2023 15:18:44 GMT

POST
H2 200 doq.htm Show response
rt3024.infolinks.com/action/ 2 KB
2 KB 126ms
83ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3024.infolinks.com/action/doq.htm?pcode=utf-8&r=17002354866181
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0099e206bbeb5cf3f34478e7af9477ddf71b7beb4c8476a62dd50bc74d150abf

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-language: en-CA
cf-ray: 82790f0fbb8f398d-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 43ms
43ms Ping
text/plain 142.250.31.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-3VRGCWTSLB&gtm=45je3b81v9123192625&_p=1700235486443&gcd=11l1l1l1l2&dma=0&ul=en-us&sr=1600x1200&cid=1411481306.1700235486&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&dt=Anyfile%20Notepad&sid=1700235486&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1188
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.31.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bj-in-f113.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 apiserving
csp.withgoogle.com/csp/ Frame 8A58 0
0 123ms
50ms Other
text/html 172.253.115.141
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.withgoogle.com/csp/apiserving
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.115.141 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f141.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://content.googleapis.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/csp-report

Response headers

GET
H3 200 googleapis.proxy.js Show response
apis.google.com/js/ Frame 8A58 18 KB
7 KB 48ms
48ms Script
text/javascript 142.251.16.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/googleapis.proxy.js?onload=startup

Requested by

Host: content.googleapis.com
URL: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

sffe /

Resource Hash

f92e7baf6054ada951110842b4751571b3b16b43e826ff46eb36520f0294f59d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 17 Nov 2023 15:38:06 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7117
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "5f95998ecb7c0577"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Nov 2023 15:38:06 GMT

GET
H2 200 iquid.js Show response
resources.infolinks.com/static/ 54 KB
13 KB 37ms
36ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/iquid.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c35a725ae1976af59c99556ad69e993dd9cf474033a75bb9406d59819d573d4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
server: cloudflare
age: 2388
etag: W/"d8c3-5f7533fc75a6e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82790f0fac67a21d-YYZ
expires: Sun, 17 Dec 2023 14:58:18 GMT

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 10 KB
4 KB 78ms
34ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5194891d3a8501374db8afe22463ed2a49fa28f22eaa4a1991d2e6e8a15191e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:07 GMT
server: cloudflare
age: 111672
etag: W/"6540128b-2675"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 82790f0fecb036d4-YYZ
expires: Mon, 20 Nov 2023 15:38:06 GMT

GET
H2 200 id5.js Show response
resources.infolinks.com/static/ 58 KB
17 KB 32ms
31ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/id5.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 26 Mar 2023 15:25:02 GMT
server: cloudflare
age: 1133
etag: W/"e65f-5f7cf3aed6f0f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82790f0fac69a21d-YYZ
expires: Sun, 17 Dec 2023 15:19:13 GMT

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 92 B
933 B 116ms
41ms XHR
text/html 108.138.64.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=328512134&pt=17&dpn=1&jsver=5.36&iiqidtype=2&iiqpcid=8bd86546-cd31-469b-89b6-5f82d8b80287&iiqpciddate=1700235486707&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=914_1700235486708&fbp=622056553&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/iquid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-85.iad12.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: 290e0b2a0facf520e51e57ad7f3a6f2f577206473aaa35ce9bd302d6a143fc4b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
pragma: no-cache
server: Apache-Coyote/1.1
vary: Origin
access-control-allow-methods: POST, GET
content-type: text/html
access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-max-age: 3600
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: EC44bWBoBOFz3RESRiISXG0TGjv2dZQPGo6mn-RUXihmQCy2k0IAdA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/
Redirect Chain

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=72870&iiqidtype=2&iiqpcid=8bd86546-cd31-469b-89b6-5f82d8b80287&iiqpciddate=1700235486707&tsrnd...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=72870&iiqidtype=2&iiqpcid=8bd86546-cd31-469b-89b6-5f82d8b80287&iiqpciddate=1700235486707&tsrn...

43 B
1 KB

88ms
84ms

Image
image/gif

52.85.132.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=72870&iiqidtype=2&iiqpcid=8bd86546-cd31-469b-89b6-5f82d8b80287&iiqpciddate=1700235486707&tsrnd=40_1700235486708&fbp=622056553&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=Z1DbPsdTtN&nc=false&trid=-1779691422
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 52.85.132.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-132-68.iad50.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: r6sAklDQA_X5jxX4WyfTJB73ZY-PJbf-kWvMC42rayv3nvIlpYHroA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=72870&iiqidtype=2&iiqpcid=8bd86546-cd31-469b-89b6-5f82d8b80287&iiqpciddate=1700235486707&tsrnd=40_1700235486708&fbp=622056553&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=Z1DbPsdTtN&nc=false&trid=-1779691422
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: hZrO9VrlFVqgg81p_-BywkOMdUBo9_zHL2N2E5patQH_lLkhQnSvFg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
285 B 350ms
116ms XHR
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

d8f458396059d2dd6830684fa324411ea84953bf17c21d84d44f7e0091ed1565

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Fri, 17 Nov 2023 15:38:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2

200

/
onetag-sys.com/match/ Frame F1EC
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=17c76557-88de-4a00-9657-b2aa8110b950&gdpr=1&gdpr_consent=

0
340 B

40ms
40ms

Image
text/plain

51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=17c76557-88de-4a00-9657-b2aa8110b950&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Fri, 17 Nov 2023 15:38:06 GMT
Server: MT3 1075 283b7e3 master iad iad-pixel-x10 config_version:"455"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=17c76557-88de-4a00-9657-b2aa8110b950&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 17 Nov 2023 15:38:05 GMT

GET sync.php
pixel-eu.rubiconproject.com/exchange/ Frame F1EC 0
0

GET
H2

200

/
onetag-sys.com/match/ Frame F1EC
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6970583706083711862

0
340 B

35ms
35ms

Image
text/plain

51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6970583706083711862

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
an-x-request-uuid: ea3dabee-e2f0-46a7-ac89-916ca712d62c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6970583706083711862
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame F1EC
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=3&uid=11ef533d11622fda09ad84f69339a3f&gdpr_consent=&gdpr=1

0
340 B

35ms
34ms

Image
text/plain

51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=3&uid=11ef533d11622fda09ad84f69339a3f&gdpr_consent=&gdpr=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:06 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=3&uid=11ef533d11622fda09ad84f69339a3f&gdpr_consent=&gdpr=1
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1700235486823058-252

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame F1EC 42 B
775 B 157ms
39ms Image
image/gif 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=7EVrCce6PtJ2bfkfPZJuDYQU14mZWR76XUkvyRJ_hI8
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F1EC
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABi93upiN6n6KMun54Uiql3lZPAKy65LzrLQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABi93upiN6n6KMun54Uiql3lZPAKy65LzrLQ&google_tc=

170 B
243 B

48ms
48ms

Image
image/png

142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABi93upiN6n6KMun54Uiql3lZPAKy65LzrLQ&google_tc=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABi93upiN6n6KMun54Uiql3lZPAKy65LzrLQ&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 318
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ Frame F1EC 0
44 B 92ms
34ms Image
text/plain 216.22.16.4
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 216.22.16.4 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame F1EC
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=7EVrCce6PtJ2bfkfPZJuDYQU14mZWR76XUkvyRJ_hI8

43 B
479 B

388ms
37ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=7EVrCce6PtJ2bfkfPZJuDYQU14mZWR76XUkvyRJ_hI8

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:07 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QZENY3VVBCNV69VSD14Z
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=7EVrCce6PtJ2bfkfPZJuDYQU14mZWR76XUkvyRJ_hI8
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame F1EC 0
39 B 31ms
27ms Image
text/plain 162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame F1EC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm=&google_tc=
https://onetag-sys.com/match/?int_id=106&google_gid=CAESECbE-n4obfewOQ5xlQi6Xh0&google_cver=1

0
340 B

36ms
35ms

Image
text/plain

51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESECbE-n4obfewOQ5xlQi6Xh0&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESECbE-n4obfewOQ5xlQi6Xh0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame F1EC 0
15 B 41ms
38ms Image
text/plain 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame F1EC
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=

0
340 B

36ms
34ms

Image
text/plain

51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=29&uid=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=
date: Fri, 17 Nov 2023 15:38:06 GMT
server: Kestrel
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame F1EC 43 B
235 B 134ms
43ms Image
image/gif 35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Fri, 17 Nov 2023 15:38:06 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 onetag-usync
router.infolinks.com/dyn/ Frame F1EC 35 B
208 B 53ms
51ms Image
image/gif 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/onetag-usync?uid=7EVrCce6PtJ2bfkfPZJuDYQU14mZWR76XUkvyRJ_hI8
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f102d19a21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ Frame 8A58 77 KB
27 KB 36ms
35ms Script
text/javascript 142.251.16.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/googleapis.proxy.js?onload=startup

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84b4d9bd7d1de7f01972743862afa12b6899d2015e89eebfb7cac12232611e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 02:49:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132505
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27742
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Nov 2024 02:49:41 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame A7E1
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
555 B

1122ms
32ms

Document
text/html

23.62.25.120
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.62.25.120 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-25-120.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 17 Nov 2023 15:38:07 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 17 Nov 2023 15:38:06 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame AD24
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1700235486701.6&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26predire...
https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

16 KB
6 KB

93ms
29ms

Document
text/html

23.197.40.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.197.40.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-40-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=63702
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Fri, 17 Nov 2023 15:38:07 GMT
expires: Sat, 18 Nov 2023 09:19:49 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP020
x-33x-status: 40000000008200000C

GET
H3

200

match
events-ssc.33across.com/ Frame 60F8
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=the33across&gdpr=0&user_id=eBp5EHYXKRFjHnwTeR9hRS0aKEVjH3xDKx8sHaYS
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=3552845a-9441-4071-92ee-4ba7807e413d
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=3552845a-9441-4071-92ee-4ba7807e413d&ts=1700235494&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

40ms
40ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=3552845a-9441-4071-92ee-4ba7807e413d&ts=1700235494&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:14 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:13 GMT
referrer-policy: unsafe-url
server: 33XP020
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=3552845a-9441-4071-92ee-4ba7807e413d&ts=1700235494&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 60F8
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-XthH_4lE2uESmEACAVPGNrLMew2VqSR6~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-XthH_4lE2uESmEACAVPGNrLMew2VqSR6%7EA&ts=1700235487&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

1088ms
43ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-XthH_4lE2uESmEACAVPGNrLMew2VqSR6%7EA&ts=1700235487&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:08 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-XthH_4lE2uESmEACAVPGNrLMew2VqSR6%7EA&ts=1700235487&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame 60F8
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=7cad7eb7fbb62359&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAMyX8Rwbw-LwMEybXDAAAAAAA&expiration=1700321894&is_secure=true&us_privacy=
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMyX8Rwbw-LwMEybXDAAAAAAA&ts=1700235494&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

40ms
40ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMyX8Rwbw-LwMEybXDAAAAAAA&ts=1700235494&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:14 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMyX8Rwbw-LwMEybXDAAAAAAA&ts=1700235494&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 60F8
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID
https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=4667789459507755246099
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=4667789459507755246099&ts=1700235487&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

1086ms
41ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=4667789459507755246099&ts=1700235487&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:08 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=4667789459507755246099&ts=1700235487&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame E285
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZVeI3rn5NE_liTNwhcDopAAABRYAAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZVeI3rn5NE_liTNwhcDopAAABRYAAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

106ms
67ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZVeI3rn5NE_liTNwhcDopAAABRYAAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:07 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 7HFW2TPKBGGYZ71BHC9R
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:07 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: BNG9CWVRM6ZA9QKR56TN
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZVeI3rn5NE_liTNwhcDopAAABRYAAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E285
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c522ed6f-4218-494d-9ed7-6f4d15b0c678&expiration=1702827486&gdpr=0&gdpr_consent=

43 B
737 B

52ms
51ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c522ed6f-4218-494d-9ed7-6f4d15b0c678&expiration=1702827486&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W%2FciuTQJijgIQKt%2FawNR6zx7GT%2FR%2FnpQi2LAHVansMU7FPa88%2Fgf0249zJ5HPaP%2BmsVAgR1LB7ddUknuX485ruPh33waORQXaNcsYCC2zJZMksbyG8v%2FqjTFIL2OKlDDV6kgVLWmTJtwnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f111b7936af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c522ed6f-4218-494d-9ed7-6f4d15b0c678&expiration=1702827486&gdpr=0&gdpr_consent=
date: Fri, 17 Nov 2023 15:38:06 GMT
server: Kestrel
content-length: 323

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E285
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZVeI3rn5NE-liTNwhcDopAAA
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm=&google_sc=&google_hm=ZVeI3rn5NE-liTNwhcDopAAA&google_tc=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1

43 B
771 B

47ms
47ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eEl2uiGUks%2FQ%2BwIJzauFG10hK6yjoqe5V1kCt3C6eYGqtNNepMRYZeHk9HS%2FJ60GV0J%2BihaEyPdb2nUKJaQ8JSLq5LgtONdV4GqfSDcOwV93dbbyPd%2FjYngMhZ7qFa78n2CA3RqoA%2FxzUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f111b7e36af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET 31327
i.liadm.com/s/ Frame E285 0
0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E285
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=Z2V-OGloLjl8YXs7NGlmOmdkL2p8YCo-YmO8EW9M

43 B
736 B

55ms
54ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=Z2V-OGloLjl8YXs7NGlmOmdkL2p8YCo-YmO8EW9M
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aHiKbLWXQrzFTkE19rbgHuLWAy5Gb%2FwgP2hXxUjY5lWCwlZVzACPWAWafh1R6EsB%2BpLp%2F22LeC%2BPqs42qSd72nwgs0sZ9dwFmMuqgP2xYn%2FCreXGmZEqnrYEchNI3BMGtiYpzESC7W%2FwkA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f3e1ec736af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=Z2V-OGloLjl8YXs7NGlmOmdkL2p8YCo-YmO8EW9M
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E285
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=bdbe9a1a-9795-4b17-ba03-52c2720e5046&expiration=1731857894

43 B
733 B

48ms
48ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=bdbe9a1a-9795-4b17-ba03-52c2720e5046&expiration=1731857894
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VA00C7PhAue4LKx8yhBAARo8qHLcqEIzyxYuwg%2Fq1sC%2BfjY%2Fg0xB13s16eN%2Fc7q8soTedy84AJpHvpyEMgSalB2HdZ60QcwzgPwxzVPMd7CdHr7EAgL%2BfZJ53suSbJ0a2igrIxiMnbkjXA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f3e5f2336af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=bdbe9a1a-9795-4b17-ba03-52c2720e5046&expiration=1731857894
Date: Fri, 17 Nov 2023 15:38:14 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E285
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AACHm07KrxIAABMvGus4Jw&expiration=1701445089

43 B
731 B

48ms
48ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AACHm07KrxIAABMvGus4Jw&expiration=1701445089
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gjadh8UcLzyx5vArekpoxSAkPY3KnXTFZ7woTfMYD5tcd73kDxbyjCFjfFK2WdH3cU4rG9g2kpk1ozz8O5TVPFTd2xaj2vlDv48ulbNkGTmPpjY6q%2FXDTOZwc9Zcf6XvGdp7%2BnvVthwa3g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f23afd136af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AACHm07KrxIAABMvGus4Jw&expiration=1701445089
Date: Fri, 17 Nov 2023 15:38:09 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E285
Redirect Chain

https://ad.turn.com/r/cs?pid=21
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=4339169849464630369

43 B
727 B

48ms
48ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=4339169849464630369
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uG6Y8ZjsNU5H0lP1bQeQ8KLuI1xujz28BOyRtOJdlQqC7usbpoWdC4qQhAILXRu6bdOo5V3M43O74R1NfT19LcQKkiH%2FY4mUMpk9fQJRPKQSo1aiS8HP0ttg6imXd4oqyi95Xeqz96MAtA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f2458dc36af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=4339169849464630369
pragma: no-cache
date: Fri, 17 Nov 2023 15:38:09 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 200 ix-usync
router.infolinks.com/dyn/ Frame E285 35 B
209 B 63ms
62ms Image
image/gif 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ix-usync?uid=ZVeI3rn5NE-liTNwhcDopAAA%261302
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f104d3ea21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:06 GMT

GET envelope
lexicon.33across.com/v1/ 0
0

GET
H2 200 in_search.js Show response
resources.infolinks.com/js/1895.006-3.034/ 225 KB
89 KB 55ms
54ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/in_search.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d1b618b508d6e2c3ab4c4d98feeddfdb66e6d87d9dcfd88097f1d85480c3af0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 12072
etag: W/"38471-6099387db3d85"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82790f104d40a21d-YYZ
expires: Sun, 17 Dec 2023 12:16:54 GMT

GET ima3.js
imasdk.googleapis.com/js/sdkloader/ 0
0

GET
H2 200 container-3.0.html Show response
resources.infolinks.com/static/ Frame 23BF 1 KB
689 B 63ms
62ms Document
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/container-3.0.html
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71cb550e3eed0fa766ffd5596c6d7fd0460a06fca3483d762d0b0fd36731a100

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 12563
cache-control: max-age=2592000
cf-cache-status: HIT
cf-ray: 82790f105d57a21d-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: Sun, 17 Dec 2023 12:08:43 GMT
last-modified: Thu, 02 Nov 2023 07:15:03 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/oauth2/v2/ Frame 8A58 6 KB
2 KB 38ms
36ms XHR
application/json 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/oauth2/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a1d6b68a866302b8ea5ab414b02d7a847b9d9336c4a7485d395041c5e916e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Fri, 17 Nov 2023 15:36:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 90
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="federated-signon-mpm-access"
vary: Accept-Encoding
report-to: {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]}
content-type: application/json; charset=UTF-8
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Nov 2023 16:26:36 GMT

GET
H2 200 getads.htm Show response
rt3024.infolinks.com/action/ 8 KB
6 KB 539ms
539ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3024.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22article%22%2C%22scs%22%3A%22AK26Kx67tJ%22%7D%5D&rid=84cec0ae-846e-4e33-9f9f-679218bf772f&jsv=1895.006-3.034&sr=1600X1200&rts=1700235486840&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=119.0.6045.159&dv=p&ce=t&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&tzo=-0800&c=c&strg=true&pitc=1~JAQrYhAO6SCs2ZIpy1_o-FCJMz904nN-&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=66MCrwdcyTE5VFVN37G3QEHuM6z2XDGUopO1ikFsmEwzile64riJIungTBt7HTF4MwzIcnlUBpjj0TOcCB2TbYUZbdOe4vtNcUkYVCODWOIyjPSXqn9DV-XniW7UB5w8BrxKXpxipI1ClGWZzcmjJiSFYAxwFcjd&rsk=95&rcs=kyvbkCQ-QKGSTfoKHd22vg&cuid=f70e2aa5-7678-435b-8f20-bcd095ce481a&_pubcid=79406d0d-168b-4781-9d6c-aa33d0764df9&ique=&hbnr=false
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ad8b39ad8cb0cc95da42f2faec620fa91ddf347e6245b29f74f5ff4f2f4600f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: en-CA
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 82790f10dde6a21d-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

amd-us
router.infolinks.com/dyn/ Frame 23BF
Redirect Chain

https://tracker.exchange.amitydigital.io/sync?id=11&uid=f70e2aa5-7678-435b-8f20-bcd095ce481a
https://router.infolinks.com/dyn/amd-us?user_id=3e0f154b-3343-8eff-5b35-f4867c9f8a6d

35 B
246 B

70ms
68ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/amd-us?user_id=3e0f154b-3343-8eff-5b35-f4867c9f8a6d
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f11cf1ca21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:07 GMT

Redirect headers

location: https://router.infolinks.com/dyn/amd-us?user_id=3e0f154b-3343-8eff-5b35-f4867c9f8a6d
content-length: 100
content-type: text/plain; charset=utf-8

GET
H2

200

ta-usync
router.infolinks.com/dyn/ Frame 23BF
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_device_id=f70e2aa5-7678-435b-8f20-bcd095ce481a=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7BTA_DE...
https://pixel.tapad.com/idsync/ex/receive/check?partner_device_id=f70e2aa5-7678-435b-8f20-bcd095ce481a=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=6f8959c5-e976-46b0-b6ef-904e97900d6b%252Chttps%25253A%25252F%25252Frouter.infolinks.com%25252Fdyn%25252Fta-usync%25253Fui...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c522ed6f-4218-494d-9ed7-6f4d15b0c678&ttd_puid=6f8959c5-e976-46b0-b6ef-904e97900d6b%2Chttps%253A%252F%252Frouter.infolinks...
https://router.infolinks.com/dyn/ta-usync?uid=6f8959c5-e976-46b0-b6ef-904e97900d6b

35 B
199 B

57ms
56ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ta-usync?uid=6f8959c5-e976-46b0-b6ef-904e97900d6b
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f13d9bda21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:07 GMT

Redirect headers

date: Fri, 17 Nov 2023 15:38:07 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://router.infolinks.com/dyn/ta-usync?uid=6f8959c5-e976-46b0-b6ef-904e97900d6b
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

152mus
router.infolinks.com/dyn/ Frame 23BF
Redirect Chain

https://sync.adkernel.com/user-sync?zone=202694&t=image&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F152mus%3Fuid%3D%7BUID%7D
https://ib.adnxs.com/getuid?%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D202694%26dsp%3D639242%26t%3Dimage%26uid%3D%24UID
https://sync.adkernel.com/user-sync?zone=202694&dsp=639242&t=image&uid=6970583706083711862
https://router.infolinks.com/dyn/152mus?uid=A2090184717405653375

35 B
188 B

58ms
58ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/152mus?uid=A2090184717405653375
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f3ed87fa21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:14 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:14 GMT
Server: nginx
Age: 0
Location: https://router.infolinks.com/dyn/152mus?uid=A2090184717405653375
Cache-Control: no-store
Connection: close
Content-Length: 0

GET
H2

200

cons-us
router.infolinks.com/dyn/ Frame 23BF
Redirect Chain

https://e.serverbid.com/usersync?cspi=154&ttt=1&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fcons-us%3Fuser_id%3D%24%7BUID%7D
https://router.infolinks.com/dyn/cons-us?user_id=b743e4a8df0c4fa983e4a8df0c6fa988

35 B
244 B

69ms
69ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/cons-us?user_id=b743e4a8df0c4fa983e4a8df0c6fa988
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82790f3dfeefa21d-YYZ
content-length: 35
expires: Thu, 17 Nov 2022 15:38:14 GMT

Redirect headers

date: Fri, 17 Nov 2023 15:38:14 GMT
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://resources.infolinks.com
location: https://router.infolinks.com/dyn/cons-us?user_id=b743e4a8df0c4fa983e4a8df0c6fa988
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 0

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/drive/v2/ Frame 8A58 96 KB
11 KB 89ms
89ms XHR
application/json 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/drive/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5ebee7ed681cf6e865702062c30703a9984a2250f4eafe26693bfdbeb664cfc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Fri, 17 Nov 2023 15:38:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10933
x-xss-protection: 0

GET
H2 200 container.html Show response
78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 716F 6 KB
3 KB 38ms
37ms Document
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:38:06 GMT
expires: Sat, 16 Nov 2024 15:38:06 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ 86 KB
27 KB 35ms
35ms Script
text/javascript 142.251.16.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_1?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8937d279ce40e09299ddc9023db7c815b220a3eb280844314b3e9eb46fa0bf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 03:07:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 131443
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27759
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Nov 2024 03:07:23 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6067 624 B
689 B 131ms
60ms Document
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTVDhCwgtkBGPWpuPwBMAE&v=APEucNUnhCVJrRcp4UAWZoOoUmzcURz1OyOevJ8aBqcZwcc0R480rXseUxK6cnB9nFBqPGsbvVevR6dyT4DdBYfmkzT0OwHEjw

Requested by

Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:38:07 GMT
expires: Fri, 17 Nov 2023 15:38:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1292944/76147861/ Frame 716F 47 KB
12 KB 378ms
52ms Script
application/javascript 3.229.35.58
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1292944/76147861/skeleton.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.35.58 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-35-58.compute-1.amazonaws.com
Software: /
Resource Hash: 8aa3cbbc2fe55e34f3a4587e9eee05f92f5cbfac58a04cf45c54e5500c0ae8ec

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 716F 172 KB
61 KB 7602ms
52ms Script
text/javascript 172.253.122.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
Origin: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 10:23:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18898
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 10:23:16 GMT

GET
H2 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 716F 7 KB
3 KB 35ms
35ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:23:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58466
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Nov 2023 23:23:41 GMT

GET
H2 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 716F 23 KB
9 KB 35ms
35ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:38:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57598
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Nov 2023 23:38:09 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 716F 41 KB
14 KB 1121ms
40ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 03:01:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 131798
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Nov 2024 03:01:30 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 716F 3 KB
1 KB 1135ms
54ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 03:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44657
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 03:13:51 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 716F 20 KB
9 KB 1117ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 02:58:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45579
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 02:58:29 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 716F 42 B
118 B 61ms
59ms Image
image/gif 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C6hMqiZzzoo2syA6GEOUKCEdYdMQH1hQpx6lU-Bd3i9w8rIijcNQultSi46xlaxev9BaRUSqEzECfoV0iUBSRIRpHouDAfu7-a9ppdFpeL2nyb9AM

Requested by

Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 716F 203 KB
64 KB 49ms
47ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

sffe /

Resource Hash

f68b49b743e29d28f46d9321318cd1fbdc017ddd6a4bdcdac1730ffc20b9f60e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65395
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700052045412510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Nov 2023 15:38:07 GMT

GET
H3 401 userinfo Show response
content.googleapis.com/oauth2/v2/ Frame 8A58 304 B
251 B 66ms
65ms XHR
application/json 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/oauth2/v2/userinfo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

ESF /

Resource Hash

a9ec945a24875fc594683ac8c3e176f2c199ed1011c8e1eec897d66c392d17b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 228
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 535.json Show response
id5-sync.com/g/v2/ 603 B
1 KB 1628ms
116ms XHR
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/535.json

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

8d31b1f464e91335a1b36866197f55cc5b2180df7d7433e5a336d1c1b351d0c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Fri, 17 Nov 2023 15:38:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6067
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1

43 B
736 B

61ms
61ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTVDhCwgtkBGPWpuPwBMAE&v=APEucNUnhCVJrRcp4UAWZoOoUmzcURz1OyOevJ8aBqcZwcc0R480rXseUxK6cnB9nFBqPGsbvVevR6dyT4DdBYfmkzT0OwHEjw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pts2JSRryDeOkkxqEU8q8IcfkD3aTrUoEV%2BV%2Fpx%2BiXdDb%2Bq7PogEgjk8kSbcanR6TjbROWDinfC5CTC7Ut5wI%2BscZD55mHtNX6%2BWcPZP3QqkOaro1sWItK9p3AE5BfCZrcvEnsVxzM1CTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f12de3536af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6067
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVeI3rn5NE-liTNwhcDopAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1

43 B
730 B

51ms
50ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTVDhCwgtkBGPWpuPwBMAE&v=APEucNUnhCVJrRcp4UAWZoOoUmzcURz1OyOevJ8aBqcZwcc0R480rXseUxK6cnB9nFBqPGsbvVevR6dyT4DdBYfmkzT0OwHEjw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6uvM6GTnvR9o0LSaSamXNO91zagRsho8TNuiM16xScSO%2F0CXMk0LoRe14D3DxcMj5PCYGNwaxzuyp3bM3yWNgJoqoDBXAu6glZpolulbGwy4%2Bv1LBmEN5TNDUVMRvVcmvmq4ybHFSBh0BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82790f132ec236af-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELFqdpSQkK8xHuIPDXFM1tM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 6067
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAG6I_qFymnusPxxhUE1ur4&google_cver=1

43 B
842 B

59ms
59ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAG6I_qFymnusPxxhUE1ur4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTVDhCwgtkBGPWpuPwBMAE&v=APEucNUnhCVJrRcp4UAWZoOoUmzcURz1OyOevJ8aBqcZwcc0R480rXseUxK6cnB9nFBqPGsbvVevR6dyT4DdBYfmkzT0OwHEjw

Protocol

Server

68.67.160.75 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
an-x-request-uuid: 1c1462cc-8d50-4884-a5f1-e4ea23744edd
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAG6I_qFymnusPxxhUE1ur4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6067
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njk3MDU4MzcwNjA4MzcxMTg2Mg%3D%3D

170 B
188 B

47ms
46ms

Image
image/png

142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njk3MDU4MzcwNjA4MzcxMTg2Mg%3D%3D

Requested by

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
an-x-request-uuid: 2b76afbc-a1a0-417c-b275-050a0018442e
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njk3MDU4MzcwNjA4MzcxMTg2Mg%3D%3D
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 main.19.8.460.js Show response
static.adsafeprotected.com/ Frame 716F 212 KB
66 KB 127ms
40ms Script
application/javascript 18.165.83.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.460.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1292944/76147861/skeleton.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-107.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dbba7a0a828407bde3a0515ca668d1ef40acc6af29aab00fc406e09cca057b8e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 15:27:46 GMT
x-amz-version-id: j9JzYHB_H4GBzJz8aV8.4QtGR1pgZCoW
content-encoding: gzip
via: 1.1 3ea826f29560ca95cae18534029cc5a6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P3
age: 259822
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 13 Nov 2023 22:15:44 GMT
server: AmazonS3
etag: W/"4d9d0e864ab105d8059c18b98a69d851"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: TmkOlPIcyhvCBdzqPPoG1Gccav859tmQpkGjHqrpZ2jJsTMi4jHdoA==

GET
H2 200 adview.htm Show response
rt3024.infolinks.com/action/ 0
166 B 64ms
64ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3024.infolinks.com/action/adview.htm?rid=84cec0ae-846e-4e33-9f9f-679218bf772f&bdc=1&midx=0&emd=MzI0fjM5NDFfNzcyMjE3OTN-NzcyMjE3OTM&rts=1700235487394&prod_t=d&jsv=1895.006-3.034&skin=sidebar&theme=nologo&sdata=article&scs=AK26Kx67tJ&rsd=66MCrwdcyTE5VFVN37G3QEHuM6z2XDGUopO1ikFsmEwzile64riJIungTBt7HTF4MwzIcnlUBpjj0TOcCB2TbYUZbdOe4vtNcUkYVCODWOIyjPSXqn9DV-XniW7UB5w8BrxKXpxipI1ClGWZzcmjJiSFYAxwFcjd&rsk=95&rcs=kyvbkCQ-QKGSTfoKHd22vg
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
cf-ray: 82790f144adc398d-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ab Show response
lax1-ib.adnxs.com/ Frame 420F 20 KB
9 KB 3337ms
120ms Script
application/javascript 104.254.151.69
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKBOPBMARwAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmNzBlMmFhNS03Njc4LTQzNWItOGYyMC1iY2QwOTVjZTQ4MWHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTU0MzkzNjkyN_ICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO3ZhciBsPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bmN0aW9uKGEsYyl7cmV0dXJuIEFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoYSxjLHZvaWQgMCl9OmZ1bmN0aW9uKGEsYyl7aWYoInN0cmluZyI9PT10eXBlb2YgYSlyZXR1cm4ic3RyaW5nIiE9PXR5cGVvZiBjfHwxIT1jLmxlbmd0aD8tMTphLmluZGV4T2YoYywwKTtmb3IodmFyIGU9MDtlPGEubGVuZ3RoO2UrKylpZihlIGluIGEmJmFbZV09PT1jKXJldHVybiBlO3JldHVybi0xfTtmdW5jdGlvbiBtKGEpe21bIiAiXShhKTtyZXR1cm4gYX1tWyIgIl09ZnVuYy2VBH07EdV0IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7EUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJTIIZSl7IZoUYj0hMTtiGVKAYj8hMTpiO2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7AVEUZD1uKGEuEZcQKTtpZigNawRmPRHICCgpexkXBGc9WlMARCxoPWwoZyxkKTswPD1oJiZBcjYFAiRzcGxpY2UuY2FsASdsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAMGImJihkLmF0dHJpYnVBHhRTcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BMcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3RhYAB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXeDGE9Yy6J1nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWshKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRh0KCksYz1h8X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAkMDw9Yz9hLnN1YhZaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CX0dxRXI1M0pMQktYUmtNdW0wOEkzb25JS2c0VTRIS19iNjlJQ0F1dDRITXN0d1FKZy1hc3VnZHBSN1VVdm8yRk90am90T0ZVT0NSVDVQVkttb2VjaVRYaFZEMkxnbkxFanhyU0J5MkpORFA5aWx0VSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS98ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaLwwIiQE8KX82HQEWJQpQYWRzLmcuZG91YmxlY2xpY2submV0MRs8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dORwge3IzcHgoJya7DBwnKTt9KSgpO10AEOoWChBIAZ40UE9SVF9QQVJBTVMS1RaROYqVAPCkYWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTA1Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9YW55ZmlsZS1uPiMOECZzdWJfDZUAYkGx8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUZrWHRBQkJIYlFBakljMEFjT05OQUYwa1RRQjRaSTBBWkdUTkFFTGxEUUJVWlEwQWNpVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBVS1XTkFGd2xqUUJkSlkwQVhhV05BRjgBECxnNVkwQVk2V05BR1IBEBhvSlkwQWFpARAAcgEQCHJaWQGAEFdOQUhTARAAMwEgAGUFEABtARAYNnBZMEFldQEgADQBEEBBWmMwQVFxWE5BRXdselFCTwEQGFVDWE5BRkIBEBhRcGMwQVVlARAAUQEQFFU1YzBBVwUg9EkETGMwRUJVM05CQVZoelFRRmFQTm9CSDRRSEFuOGVYQUphLVlnQzVmMklBaWRDcWdJN1dxb0NJMjZxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xGdGFvQzhfV3FBbW40cWdJbS02b0NRZnVxQWxFTHF3SThJNnNDaENlckFsUW9xd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQW1JN3F3SzFQS3NDQWotckFteEtxd0pSVGFzQ3dFMnJBbUJPcXdLNFRxc0M5RkNyQWdKUnF3SUtVYXNDaTF1ckFpQmNxd0lXWXFzQzVHU3JBc05ucXdJUGFxc0NHWEdyQXRkeHF3THhjYXNDc0hLckFvQnpxd0xNZEtzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDVTRDckFyaUFxd0tiZ2FzQ040S3JBbktIcXdLNWg2c0NvSXFyQXNpTHF3SUFqS3NDc295ckFyYU1xd0s0aktzQ0FwQ3JBdWFScXdJWWxhc0NISmFyQWxDWHF3TEdsNnNDREppckFnNmFxd0xybmFzQ01aNnJBc1dlcXdMT25xc0NBNS1yQXZPZnF3TFZvYXNDNzZHckFqV2lxd0tWbzZzQ3FxT3JBdHFrcXdMcHBxc0NNYWlyQWdDcHF3S2lxYXNDMmFtckF2eXBxd0lkcXFzQzI2dXJBbHF0cXdJVnJxc0NKYTZyQWtLdXF3SkVycXNDYzY2ckF1Q3Vxd0k3cjZzQ2c2LXJBcC12cXdJSnNhc0NGckdyQW5XeHF3S3JzYXNDWXJLckFudXpxd0tzczZzQ0ZyU3JBaHEwcXdJaHRLc0NKYlNyQWltMHF3STZ0S3NDaHJTckFnbTFxd0lGdHFzQ0o3YXJBdXUycXdJV3Q2c0NKYmVyQWoyM3F3S0t0NnNDYXJpckFwRzRxd0xhdUtzQzc3aXJBaUs1cXdJcXVhc0MtYm1yQWlPN3F3SW11NnNDTWJ1ckF1cTdxd0xCYkNRRXNGMzNCSVcweFFXdHptVU9XYlg3RWxuSy14S1Q2dnNTTEE3OEVyUU9fQkpXRF93U3JSTDhFcTRUX0JKaUdQd1NlQmo4RXN3Wl9CSmtHX3dTd3h2OEV1a2JfQklNSGZ3U09SMzhFdWNkX0JMcEhmd1NaMTNRRTFaZHl5Ylc4RmtveXN1MUxnJmV4az0xNTQzOTM2OTI3JmF3YmlkX2M9QUtBbWYtREJUWU1RVEQzOWJfMHN0VXpxOXgxNzdmNEJJaHk4ZFJwNl9zbHBBcksxQVFYaDVJZXVFQWNjLUhSc1VnSDN3ZThCSXg1bERIV0NBT2ZxeGZ5ODgyYXhuaGJuMnJjcloyOGZwWW9SLS1sMm9aNjBYNURvWG92WHdxMFhFallOcHFxOVdkMVZhLWh1b2VSSkMxbEpLdGtILVZ0ajJkN1pZc3lPMzFvcTVjci1rcktCLWRr7b0AZO299CsFQWRUZGQ2RThQR0xOM1NZSldXU2F4b0UydnlaX1pMUlJEazNLMzlxa3FZcUpDVWdMaXRPdmkwbHRVNzhfeGpYWjFwVUZNc1ppMXFFa0RwV3F4RVFLdHNMMHFVNExzSmM5ajBNWV9weXZiTEFGQVJ4RHpzR0hlRGJqZzVFX01oVTNocDFvXy1WQXZhMWF5djJxTkE2WnFEYUtqVy1tNnJyVWZoYWhHT3JaNkVxcmlObHVUeWt1VzlnV3VjVUpQd3l5bEN1NEJaMldYaWRFSGZlWXotcU5GUXpwTEl4emQ0MUhrQmh3SHlnWk5vN0FXSnhldzdPVlBuaTlDQ3FQVTFYV24wTEhrWlFsdk5EbUs0Vnc1bzFCRDBjZDVPWnV6TjRJLXktQS1ydWJPeFBjaFVXWHo5MXR6SU13ZDNDeWFoVW5JYmdKdHBaMEhQSXdPTVVzaUJnTjNTbnllalZmSFM1aEtXRzRCWDF1S01MNExrcjg1aDFZNlZQTUdNVUQ2STNsUkpGRE1rWmliQTZrS0d0XzBfV250QjhDWmV6T3E4ak51WVluU09vN2kyMV9GUU41QmJLNWtDSDNGbGgyVjlsTkVXbEJsNmRNaEFuWUhEWGNrdmlhT1lqRlRMSGZIOXE5Ti1DOS1mN0pCNG5pdVdHaXllVmVHNUVGV2ZtMFVwU1VSQmVtWVhScEtiQ3JWZTZndFV6bll3dDZONWdKTFZzU1RvVWhlUmR2WVFzclhFZWc0WV9WZGFHY0Z5S3FWdUZzdXVtMzh1UjI3Vk1XcjZiSkZQR3pTUjEyN1pwZVg4RllDakdLNGRVQXp4emZtMzdrdlRRV2VyN0I1bmcxQXNNX2M5NmRhVVNRVEJ3VWJpaUFrQmhQUFh2bEZRMnkzbWZYQVhTNTBpaGJySm9YWjJsbUowWDR3ZDZFRFJWc25PLWZ4YW55dExRN3NwdHk5VHlqOE82em9DMVdOSTVVc095V056VXpnNk80NFhLRHo0MmFPMERUUU45UHlnR3loUVBrNFRHUzZZTXYwOWxSUDVsS29jRVlGbFdlU1NhYU4wR2V3NHNIdmpiUzhPN1RUTW4wdFJQY2J3X0ZDRFJRTnB3ZTFTU0RlREEwUkdYS1pZWkoyUEZPOUJveWZFNldTV2JiZm1JYWJXNmdfQXA1RXdRMVpGM3RsejFjZmRPSWJkRzlTMmg1RndpajJPYzlOWGFSU3RuZG1ibFBPc3RXaUtZNlEyYkh1c0FIT083SHVKRVZoTE9CUDl6WGt5VTRIdmlCN0h3aDN6TjlicE5DLV8wbm9Bd0xLWmpRU0RLM1hGY3BFZkZzV1h5T2doR0V6YUoyOWpZNjAwNnVRRmVpWUNXRUtpTDhuelE5U0ozTXlOMkdhZVZIR3Etc2E2V25zRUxvYWhlQ1N4Mlc0cG9nNC04eWhrcm9Wdk5zSlJtMHRfd01CZHllZzB2VldvM3BVbERnNzczSXRzQnZKa0pabHBhME1FdjdOaWNxaG5FT0ZJUjhTY3FCcEw0R0huMFRnVEVEa004cmRxd1piN3Vsa2xjdFE5SVllUnViSmk2c1BBWWVrbnp4aEVMNmRiUFZGSHVzbVNQMTVhY00yQXZWUTNBRXplMTVqcSZjaWQ9Q0FRU0d3RElDYWFOU2FrRWlDUS1WLW91aF9zRUdzdnFNT1FrQW1RUmVSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP7AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeSJ2D64dDfSOATJ0RUYxSUNoVXRYczhNMjlwTjVKQnZhMnJudDdrQW4wbGdXdC0xeUVVTXljQ3dLZ01JREtSY2UtZTNoY1JvRGVQZU9pbzVXd1hmTnNrdjhVMlZmWXZ1X3dUSEU0VTNhRmk0bjUyY0dwVFhxSzRiN0kmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSMzI3NzkzOTk4MDI0OTU2MjU4Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4xOS4yMTIuMTA1qAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYyShuPS44T7bKoFKjg0Y2VjMGFlLTg0NmUtNGUzMy05ZjlmLTY3OTIxOGJmNzcyZn4zMjR-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEBIvGx0BsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHuO8F0gcNCRE4ATUI2gcGCfWo4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=347b985e8351805de5126c68884ae3bed7521f6c&pp=41.44003

Requested by

Host: blank
URL: about:blank

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.69 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

517921101d9e66a965c2dfd820b4d67f40efefb42035443aa39a6261881a0d75

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:10 GMT
content-encoding: gzip
x-creative-id: 77221793
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-proxy-origin: 37.19.212.105; 37.19.212.105; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0
pragma: no-cache
an-x-request-uuid: 57cca30b-56f2-4ddf-9b83-a4f16ccbeaa7
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame AD24 5 KB
6 KB 99ms
32ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=31166488&p=156423&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: acd6a78702e101544647bf6a4d7ba3179764b5af76193f06c02e5d181c9fb42b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 17 Nov 2023 15:38:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 716F
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1292944/76147861/skeleton.js?adsafe_url=https%3A%2F%2Fanyfile-notepad.semaan.ca&adsafe_type=y&adsafe_url=https%3A%2F%2Fanyfile-notepad.semaan.ca%2F&adsafe_type...
https://static.adsafeprotected.com/skeleton.js

17 B
464 B

34ms
34ms

Script
application/javascript

18.165.83.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 18.165.83.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-107.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 03 Apr 2023 07:19:48 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 3ea826f29560ca95cae18534029cc5a6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P3
age: 19729100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: TCjcYFVpLgOIXL3mjRec-neL7fm3po57sypYJKnE_3Xd5lNjSguVrQ==

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: nginx
x-server-name: app20.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 0FAC 91 KB
23 KB 38ms
38ms Script
application/javascript 18.165.83.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.83.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-83-107.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 02 Apr 2023 06:31:15 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 3ea826f29560ca95cae18534029cc5a6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P3
age: 19818413
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: nRZ4BDd4L_CjwpqNNWRBHvWkQrgfrshU_eNBHQJ-3SM8OEp5ePzZ6A==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 716F 43 B
215 B 266ms
88ms Image
image/gif 54.148.97.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1292944&asId=bb62d4d9-8eaa-5234-b2ee-96b2d29a5fff&tv=%7Bc:ucXwAx,pingTime:-3,time:254,type:v,im:%7BpBlk:248%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:225%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:254,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:225,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B62~0%5D,as:%5B62~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tVSKPHZ+1111%7C1112%7C112%7C113%7C12%7C13%7C14%7C15*.1292944-76147861%7C151%7C16,idMap:15*,rmeas:1,rend:0,renddet:svg.us,siq:227%7D&br=c
Requested by: Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.148.97.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-148-97-220.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: nginx
x-server-name: dt30.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 716F 43 B
215 B 263ms
89ms Image
image/gif 54.148.97.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1292944&asId=bb62d4d9-8eaa-5234-b2ee-96b2d29a5fff&tv=%7Bc:ucXwAy,pingTime:-6,time:255,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:255,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:225,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B63~0%5D,as:%5B63~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tVSKPHZ+1111%7C1112%7C112%7C113%7C12%7C13%7C14%7C15*.1292944-76147861%7C151%7C16,idMap:15*,rmeas:1,rend:0,renddet:svg.us,siq:227%7D&tpiLookup=ao:anyfile-notepad.semaan.ca*&br=c
Requested by: Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.148.97.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-148-97-220.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: nginx
x-server-name: dt32.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 96B0 43 B
855 B 42ms
41ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=96C43014-E939-462B-9840-FD6252648723&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 17 Nov 2023 15:38:07 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 4CNEVFNAX32Z0TNPYWNA

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C033
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6970583706083711862&gdpr=0&gdpr_consent=

42 B
218 B

88ms
31ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6970583706083711862&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 57e350c9-ed4c-4195-8413-d933635c1a41
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:07 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6970583706083711862&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame E907
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBNEtrN0tyeElBQUJVWURud3VuUQ&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AACHm07KrxIAABMvGus4Jw&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Csyn%252Cpm%26bee_sync_cur...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Csyn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AACHm07KrxIAABMvGus4Jw&pid=558502&do=add&gd...
https://rtb-csync.smartadserver.com/redir?partneruserid=AACHm07KrxIAABMvGus4Jw&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsyn%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=315942424790739550&gdpr=0&gdpr_consent=
https://sync.technoratimedia.com/services?uid=AACHm07KrxIAABMvGus4Jw&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D315942424790739550%26gdpr%3D0%2...
https://ssum-sec.casalemedia.com/usermatchredir?s=191740&cb=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26nuid%3D77859765EB184C419E3FA07F3B66EBE3%26att%3D1%26pid%3D82%26cb%3Dhttps%...
https://sync.technoratimedia.com/services?srv=cs&nuid=77859765EB184C419E3FA07F3B66EBE3&att=1&pid=82&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D31594242479073...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&userid=315942424790739550&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACHm07KrxIAABMvGus4Jw&gdpr=0&gdpr_consent=

42 B
279 B

88ms
88ms

Document
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACHm07KrxIAABMvGus4Jw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Fri, 17 Nov 2023 15:38:10 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACHm07KrxIAABMvGus4Jw&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 7A89
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
236 B

46ms
46ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZVeI4gAAAnJ7QABd
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Fri, 17 Nov 2023 15:38:10 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yyz4534-YYZ
x-timer: S1700235491.757862,VS0,VE21

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Fri, 17 Nov 2023 15:38:10 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZVeI4gAAAnJ7QABd
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yyz4534-YYZ
x-timer: S1700235491.718838,VS0,VE21

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 124A 0
340 B 1370ms
36ms Document
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 Miami, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Fri, 17 Nov 2023 15:38:08 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame BC94
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=528a91d0-855f-11ee-b0b7-3aa3f30e9028

42 B
322 B

29ms
28ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=528a91d0-855f-11ee-b0b7-3aa3f30e9028
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 0
content-type: image/gif
date: Fri, 17 Nov 2023 15:38:14 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=528a91d0-855f-11ee-b0b7-3aa3f30e9028
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: lga-delivery-3

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame A701
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=EsRbQxzJC0IJwF5AE5JDRkfCWREJlQ9GR8GOhuGL

42 B
423 B

85ms
83ms

Document
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=EsRbQxzJC0IJwF5AE5JDRkfCWREJlQ9GR8GOhuGL
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Fri, 17 Nov 2023 15:38:14 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=EsRbQxzJC0IJwF5AE5JDRkfCWREJlQ9GR8GOhuGL
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 53EB
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=3552845a-9441-4071-92ee-4ba7807e413d
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=3552845a-9441-4071-92ee-4ba7807e413d
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=ce554823-9c48-4512-b115-3961723b68ca&user_group=1&ssp=pubmatic&bsw_param=3552845a-9441-4071-92ee-4ba7807e413d
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=3552845a-9441-4071-92ee-4ba7807e413d&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
185 B

28ms
28ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=3552845a-9441-4071-92ee-4ba7807e413d&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:08 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Fri, 17 Nov 2023 15:38:09 GMT
Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=3552845a-9441-4071-92ee-4ba7807e413d&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 278E
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314645649146270

42 B
194 B

84ms
83ms

Document
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314645649146270
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Fri, 17 Nov 2023 15:38:08 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314645649146270
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame DE67
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=LJt-jbVIWkZwLtGKA5NrbCUT1Gk&gdpr=0&gdpr_consent=

42 B
302 B

29ms
28ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=LJt-jbVIWkZwLtGKA5NrbCUT1Gk&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:08 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Fri, 17 Nov 2023 15:38:08 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=LJt-jbVIWkZwLtGKA5NrbCUT1Gk&gdpr=0&gdpr_consent=

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame E49C
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
452 B

107ms
106ms

Document
image/gif

104.18.24.173

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.173 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 82790f44295653f5-YYZ
content-length: 43
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:15 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 82790f427ecb53f5-YYZ
content-type: text/html
date: Fri, 17 Nov 2023 15:38:14 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 50

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 46F3
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:j2uoPbQX1R40V95&gdpr=0&gdpr_consent=

42 B
220 B

29ms
28ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:j2uoPbQX1R40V95&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Fri, 17 Nov 2023 15:38:14 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:j2uoPbQX1R40V95&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-0c0676d597527ef88@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 02D9
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=1582be09-5f0c-4838-9740-a2edfce0c38c&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=96C43014-E939-462B-9840-FD6252648723

42 B
501 B

41ms
36ms

Document
image/gif

75.101.192.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=96C43014-E939-462B-9840-FD6252648723
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.192.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-192-4.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Fri, 17 Nov 2023 15:38:14 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Fri, 17 Nov 2023 15:38:14 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=96C43014-E939-462B-9840-FD6252648723
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET usersync.aspx
dis.criteo.com/dis/ Frame 3896 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame C5E3
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU19aeeff2c27d4204a40dd32598d63b0c

42 B
278 B

83ms
83ms

Document
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU19aeeff2c27d4204a40dd32598d63b0c
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:11 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU19aeeff2c27d4204a40dd32598d63b0c
pragma: no-cache
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A297
Redirect Chain

https://b1sync.zemanta.com/usersync/pubmatic/?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:bgDgZa3s-CMdJGJmyKWf&gdpr=0&gdpr_consent=&gdpr=0

42 B
339 B

71ms
28ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:bgDgZa3s-CMdJGJmyKWf&gdpr=0&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 196
Content-Type: text/html; charset=utf-8
Date: Fri, 17 Nov 2023 15:38:07 GMT
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:bgDgZa3s-CMdJGJmyKWf&gdpr=0&gdpr_consent=&gdpr=0
P3p: CP="We do not support P3P header."
Pragma: no-cache

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 24CD 0
0

GET tum
ums.acuityplatform.com/ Frame 1EE0 0
0

GET
H2 200 match Show response
events-ssc.33across.com/ Frame 98D1 68 B
225 B 835ms
40ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=96C43014-E939-462B-9840-FD6252648723
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Fri, 17 Nov 2023 15:38:08 GMT
via: 1.1 google

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame AD24
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lsQwFOk5RiuYQP1iUmSHIw%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

29ms
28ms

Image
text/html

23.197.40.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 23.197.40.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-40-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:07 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=63702
accept-ranges: bytes
content-length: 5622
expires: Sat, 18 Nov 2023 09:19:49 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame AD24
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=96C43014-E939-462B-9840-FD6252648723
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D6f8959c5-e976-46b0-b6ef-904e97900d6b%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6970583706083711862&pt=6f8959c5-e976-46b0-b6ef-904e97900d6b%2C%2C

95 B
124 B

53ms
53ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6970583706083711862&pt=6f8959c5-e976-46b0-b6ef-904e97900d6b%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:07 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
an-x-request-uuid: cccef943-b0bb-4326-9249-4b4814b88d5b
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6970583706083711862&pt=6f8959c5-e976-46b0-b6ef-904e97900d6b%2C%2C
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame AD24 0
0

GET
H2 200 xuid
eb2.3lift.com/ Frame AD24 37 B
355 B 44ms
39ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=96C43014-E939-462B-9840-FD6252648723&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 17 Nov 2023 15:38:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame AD24
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEOrbBACvrd280ryMgSzAeMo&google_cver=1

42 B
363 B

83ms
83ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEOrbBACvrd280ryMgSzAeMo&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:06 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEOrbBACvrd280ryMgSzAeMo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame AD24
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:032CF57941A041ACB53ADBDD9AD7B574

42 B
402 B

84ms
84ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:032CF57941A041ACB53ADBDD9AD7B574
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:12 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Fri, 17 Nov 2023 15:38:13 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:032CF57941A041ACB53ADBDD9AD7B574
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 16 Nov 2023 15:38:13 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AD24
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=

42 B
543 B

52ms
27ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:07 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=
date: Fri, 17 Nov 2023 15:38:07 GMT
server: Kestrel
content-length: 355

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame AD24
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=96C43014-E939-462B-9840-FD6252648723&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-BRhL0QpE2uU6wnkhLnRmNfgdrADT8UY-~A&gdpr=0

0
129 B

613ms
83ms

Image
text/plain

104.36.113.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-BRhL0QpE2uU6wnkhLnRmNfgdrADT8UY-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 104.36.113.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:07 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-BRhL0QpE2uU6wnkhLnRmNfgdrADT8UY-~A&gdpr=0
date: Fri, 17 Nov 2023 15:38:07 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET 96C43014-E939-462B-9840-FD6252648723
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame AD24 0
0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AD24
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=96C43014-E939-462B-9840-FD6252648723&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=1a0ff49542692493&is_secure=true&networkId=17100&version=1&nuid=96C43014-E939-462B-9840-FD6252648723&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMjuBoLi9jBAMJqwgEAAAAAAA&expiration=1700321888&nuid=96C43014-E939-462B-9840-FD6252648723&...

42 B
376 B

28ms
28ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMjuBoLi9jBAMJqwgEAAAAAAA&expiration=1700321888&nuid=96C43014-E939-462B-9840-FD6252648723&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:08 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMjuBoLi9jBAMJqwgEAAAAAAA&expiration=1700321888&nuid=96C43014-E939-462B-9840-FD6252648723&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame AD24 0
0

GET CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame AD24 0
0

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame AD24
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R35CA9_10C4B9E5D_3D02A8A6&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

39ms
38ms

Image
image/gif

38.68.201.140

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Protocol

HTTP/1.1

Server

38.68.201.140 -, , ASN (),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-383240294; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:14 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-383240294; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Fri, 17 Nov 2023 15:38:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET pixelSync
pixel-sync.sitescout.com/dmp/ Frame AD24 0
0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AD24
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4122997067350846561&gdpr=0&gdpr_consent=&us_privacy=

1 B
201 B

28ms
28ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4122997067350846561&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:08 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4122997067350846561&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 17 Nov 2023 15:38:09 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET match
c1.adform.net/serving/cookie/ Frame AD24 0
0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 716F 43 B
216 B 221ms
88ms Image
image/gif 54.148.97.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1292944&asId=bb62d4d9-8eaa-5234-b2ee-96b2d29a5fff&tv=%7Bc:ucXwBf,pingTime:-2,time:298,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:59,bdZ:438,beA:440,beZ:441,mfA:627,cmA:629,inA:630,inZ:635,prA:635,prZ:658,si:666,poA:667,bl:688,poZ:688,cmZ:688,mfZ:688,loA:694,loZ:698,ltA:737,ltZ:737,mdA:442,mdZ:597%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:225%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:298,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:225,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B106~0%5D,as:%5B106~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tVSKPHZ+1111%7C1112%7C112%7C113%7C12%7C13%7C14%7C15*.1292944-76147861%7C151%7C16,idMap:15*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:svg.us,siq:227,sinceFw:69,readyFired:false%7D&br=c
Requested by: Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.148.97.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-148-97-220.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: nginx
x-server-name: dt33.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 716F 43 B
215 B 139ms
91ms Image
image/gif 54.148.97.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1292944&asId=bb62d4d9-8eaa-5234-b2ee-96b2d29a5fff&tv=%7Bc:ucXwCD,time:384,type:e,im:%7BpWait:4,imprf:%7Bttecl:717,ecd:109,tsecr:0%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:384,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:225,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B192~0%5D,as:%5B192~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tVSKPHZ+1111%7C1112%7C112%7C113%7C12%7C13%7C14%7C15*.1292944-76147861%7C151%7C16,idMap:15*,rmeas:1,rend:0,renddet:svg.us,siq:227,sis:337%7D&br=c
Requested by: Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.148.97.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-148-97-220.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:07 GMT
server: nginx
x-server-name: dt31.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 716F 43 B
215 B 87ms
87ms Image
image/gif 54.148.97.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1292944&asId=bb62d4d9-8eaa-5234-b2ee-96b2d29a5fff&tv=%7Bc:ucXwG4,pingTime:-10,time:597,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHw0ODB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTkuMC42MDQ1LjE1OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1700235487960%7C%7Cdbcca99c7c1729b11d3ee3eeed570a34%7C%7C1b7de7e82db1163ab7a1342e5def95a8%7C%7C03948b6bbccb93fb58cffd44ba5f440e%7C%7C34eadb27656b9d95819b9b6d6a4bf6aa%7C%7C4ac4984df455e8ed57191472c7267966%7C%7C388afa8fa5c62187705680a66dd64ddf%7C%7C1965d63e36e3afd2fd34d724a547bd58%7C%7C1663701684%7D
Requested by: Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.148.97.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-148-97-220.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
server: nginx
x-server-name: dt27.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame A7E1 46 KB
13 KB 37ms
37ms Script
text/html 23.62.25.120
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.62.25.120 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-25-120.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f76aee1470f6c57ebb20efe18fa6cda6a13639d799390d9605da92fef94f99ce

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Fri, 17 Nov 2023 15:38:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Nov 2023 10:43:36 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=68749
Connection: keep-alive
Content-Length: 13230
Expires: Sat, 18 Nov 2023 10:43:57 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame A7E1 7 B
862 B 362ms
39ms XHR
application/json 8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 7d24643e640b7b50906469aa87bfb2ce
Expires: 0

GET
DATA 200
OK truncated
/ Frame 716F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebba8ce2c27f062a5fb8b1e5fce7f11bddc56eb6a3a9076ffe69737100649785

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F01F 38 KB
13 KB 36ms
35ms Document
text/html 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 132362
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 02:52:06 GMT
expires: Fri, 15 Nov 2024 02:52:06 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame F01F 39 KB
15 KB 36ms
35ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 12:56:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9670
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 12:56:58 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F01F 0
20 B 64ms
63ms Image
image/gif 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BwnJ03ohXZc6cJpeQj-8P5Yah6AsAAAAAOAHgBAI&bg=!aGulayTNAAZxrfrxUa07ADQBe5WfOB4B5-X3gHamNrvvnCAUK0B4HVu3aEgI08mEtp5NNeK10m0nUASDBbCyxja2rOlnAgAAAFdSAAAAA2gBBwoAPixj-KD17D2DA3F2g0qUCjFgt-byQv5zDNc7oeGmnt1b-UKND3swrVbtR404R_GSMcMkR9_OL9oJCRM4dEv6mQMAWrIsPAWqo5tTjS3cmiXX7_uCgfAxVSR_XDffGh3YZBAWaWwV37XlyVVf85sVO82XxVpaPWTz-Hg45UQKXXUzY3dpLPQYMVVvD6XGk7Uqrt56JCvmhmCzYNOnYL-CDnUv31pzmlyTvr5lHG903vE8SY_PIcSnVwZyGzounyasHbIRV1mTLBu9ZafdHOOHFQMyf8F-xjmi27k9E0vnkC-N2B4KbFZ8HlypMYpX6nXtxrI7CYimtW8euWuLhY2PkRgjuexGPPcEyX5iI_MjFZAEITZiz1de5M4hYghKUfynBIldL6k8E-wVAUPEhGttFhxVOgukCPc4nxO51HIvfyoonJ9Ulhss720dlv2SxHuoxU1pRv4we62iwkk0sZabOOHBLoDhKTfp4fJRB3O_LHMYObEq1VAi1OgEfoSBiRok_8T9qNKHytM-lbQzrx_0dJbobiD1SjaF48SmbmnEDI0XG5phwJr_mjGqN1KXob2yu2n7HCVym_HOSu-t9Zp1XJuAalMfpdj98F5FPy-ClQpf2AZTB2h79KvVm85v6jE3hOKbO4qw0yFr6SNwpk_zFFwW55xirk04HGA8BRGE2LuVlvlS2WPNfNVWlL_uYAjFzX2iBL9GoKuPkMpkfBQ_GklKVivLXFd1TU02KIGwE4fkKKCVkn8bbQt_9sZQ-7W-Y6G8vk61jPxU_Gtl24zbCOGUgoqTt7-ulkWcM0aAIqF1Jss3GuPWGboUrcz6enyPw2_O59l9RxVUI4P2KlJMWiiUAg6aUAWxbg3UvVcIDK6jKHDrBNwryWx4a8WCpQ7mTLJaZA0oRb-QETcCPLBpIRww4WJ4h8psFmRqESGvsFsDWK4gCAwdkjyaY5H_h5A9O2OXUk_h0jxuj5GnCRemGSCiNoC3Y6ECm9HXZ-ASZWRc1ulZeVCmazVQusOOaNn3r1bJNijrhyxpO2vTo5ss2kw4OWUqtdzZiRNJ-FpdhYBdiGkD7qwKuN0X4uisfK43TZMRtacVe28KgvMU3pK2lUju

Requested by

Host: 78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com
URL: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcl.htm Show response
rt3024.infolinks.com/action/ 0
37 B 70ms
70ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3024.infolinks.com/action/dcl.htm?rid=84cec0ae-846e-4e33-9f9f-679218bf772f&prod_t=d&sdata=article&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 82790f1aa9f8a21d-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame A7E1
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=LP2SB5W3-1U-B5NP
https://ssc-cms.33across.com/ps/?xi=1&xu=LP2SB5W3-1U-B5NP
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LP2SB5W3-1U-B5NP&ts=1700235488&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

40ms
40ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LP2SB5W3-1U-B5NP&ts=1700235488&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:08 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
referrer-policy: unsafe-url
server: 33XP007
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LP2SB5W3-1U-B5NP&ts=1700235488&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7E1
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=&expires=30

42 B
775 B

79ms
38ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c522ed6f-4218-494d-9ed7-6f4d15b0c678&gdpr=0&gdpr_consent=&expires=30
date: Fri, 17 Nov 2023 15:38:08 GMT
server: Kestrel
content-length: 289

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A7E1
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=YC4hIRkETPW2dodhKq-WGA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=YC4hIRkETPW2dodhKq-WGA

43 B
479 B

40ms
39ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=YC4hIRkETPW2dodhKq-WGA

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:08 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: MD6KVP3HPXTECEBRNX1P
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=YC4hIRkETPW2dodhKq-WGA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame A7E1
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LP2SB5W3-1U-B5NP

0
514 B

1432ms
83ms

Image
text/plain

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LP2SB5W3-1U-B5NP
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:09 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 5A82F24F0D674AEDA24AD7CC2E29F041 Ref B: YTO01EDGE0810 Ref C: 2023-11-17T15:38:09Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYKWuxqO5UFw5wp4AFtZQ==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LP2SB5W3-1U-B5NP
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 7d24643e640b7b50906469aa87bfb2ce
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET

MaUq301SpHpW14MHp8HyJ8n5EUdSAgOZEtemQ7w0kco
pr-bh.ybp.yahoo.com/sync/rubicon/ Frame A7E1
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/MaUq301SpHpW14MHp8HyJ8n5EUdSAgOZEtemQ7w0kco?csrc=

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A7E1
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmQwMzM5ZTBkZmNkZGM2NTE2YWM0YjljY2M0NjBkODJhMGNhOWZlZA

170 B
188 B

47ms
47ms

Image
image/png

142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmQwMzM5ZTBkZmNkZGM2NTE2YWM0YjljY2M0NjBkODJhMGNhOWZlZA

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmQwMzM5ZTBkZmNkZGM2NTE2YWM0YjljY2M0NjBkODJhMGNhOWZlZA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 7d24643e640b7b50906469aa87bfb2ce
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A7E1
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFAyU0I1VzMtMVUtQjVOUA==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECe6mV4bP1bxVFAlFRyTDaw&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFAyU0I1VzMtMVUtQjVOUA==&google_push=

170 B
188 B

47ms
46ms

Image
image/png

142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFAyU0I1VzMtMVUtQjVOUA==&google_push=

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFAyU0I1VzMtMVUtQjVOUA==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A7E1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=LP2SB5W3-1U-B5NP&ex=d-rubiconproject.com&status=ok

43 B
479 B

42ms
40ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LP2SB5W3-1U-B5NP&ex=d-rubiconproject.com&status=ok

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:08 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XMZAP6122NS160E3NEW3
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LP2SB5W3-1U-B5NP&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame A7E1 43 B
855 B 660ms
185ms Image
image/gif 52.95.122.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.122.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:09 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Q3BGSNPP9Y3ABAFCBF8A
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7E1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESECtJFFujHJHvC-mXN2me37Y&google_cver=1

42 B
775 B

132ms
37ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESECtJFFujHJHvC-mXN2me37Y&google_cver=1
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESECtJFFujHJHvC-mXN2me37Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7E1
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAA4Kk7KrxIAABUYDnwunQ&expires=30

42 B
775 B

38ms
38ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAA4Kk7KrxIAABUYDnwunQ&expires=30
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAA4Kk7KrxIAABUYDnwunQ&expires=30
Date: Fri, 17 Nov 2023 15:38:09 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame A7E1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://prebid.a-mo.net/setuid/magnite?uid=LP2SB5W3-1U-B5NP

0
451 B

3389ms
45ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LP2SB5W3-1U-B5NP
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:11 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LP2SB5W3-1U-B5NP
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H2

200

pixel
capi.connatix.com/us/ Frame A7E1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=LP2SB5W3-1U-B5NP&pId=11&gdpr=&gdpr_consent=&us_privacy=
https://capi.connatix.com/us/pixel?puid=LP2SB5W3-1U-B5NP&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true

82 B
82 B

56ms
56ms

Image
image/gif

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=LP2SB5W3-1U-B5NP&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 82790f1f1f5036fa-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Fri, 17 Nov 2023 15:38:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://capi.connatix.com/us/pixel?puid=LP2SB5W3-1U-B5NP&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 82790f1ebe9836fa-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame A7E1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LP2SB5W3-1U-B5NP

43 B
1 KB

35ms
35ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LP2SB5W3-1U-B5NP

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

68.67.160.75 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a23-204-152-232.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:08 GMT
an-x-request-uuid: f49620bb-7249-44a5-84e3-c5df83f54550
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LP2SB5W3-1U-B5NP
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H2

200

cksync
hb.yahoo.net/ Frame A7E1
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LP2SB5W3-1U-B5NP&redir=true
https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LP2SB5W3-1U-B5NP&redir=true
https://hb.yahoo.net/cksync?cs=63&axid_e=eS1kdW9TUEloRTJ1RzVjRHZuSGRVTkVPckNGV0NuMmhman5B&ovsid=LP2SB5W3-1U-B5NP&dpid=58160

53 B
646 B

380ms
49ms

Image
image/gif

23.204.152.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hb.yahoo.net/cksync?cs=63&axid_e=eS1kdW9TUEloRTJ1RzVjRHZuSGRVTkVPckNGV0NuMmhman5B&ovsid=LP2SB5W3-1U-B5NP&dpid=58160

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

23.204.152.232 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Fri, 17 Nov 2023 15:38:09 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Fri, 17 Nov 2023 15:38:09 GMT

Redirect headers

location: https://hb.yahoo.net/cksync?cs=63&axid_e=eS1kdW9TUEloRTJ1RzVjRHZuSGRVTkVPckNGV0NuMmhman5B&ovsid=LP2SB5W3-1U-B5NP&dpid=58160
date: Fri, 17 Nov 2023 15:38:08 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame A7E1
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LP2SB5W3-1U-B5NP

95 B
124 B

54ms
54ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LP2SB5W3-1U-B5NP

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

static.196.120.55.162.clients.your-server.de

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:08 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LP2SB5W3-1U-B5NP
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 7d24643e640b7b50906469aa87bfb2ce
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame A7E1 0
0

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://id5-sync.com/i/535/8.gif?id5id=ID5*rTf9g9RSruq7aipQ7QvAfgC-UHos9jpE77fNbvnWROduwRTFbHbo7nJ-lFEh9SQrbsLjnGAc6UgYy5lbaFiZjA&o=api&gdpr_consent=undefined&gdpr=false
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F434%2F7%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/535/434/7/2.gif?puid=ce8807c4-af98-4ef3-9b38-633179cb1735&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F441%2F6%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/535/441/6/3.gif?puid=u_39608bf0-b0b7-4746-8181-9656e6fff32e&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F108%2F5%2F4.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/535/108/5/4.gif?puid=6f8959c5-e976-46b0-b6ef-904e97900d6b&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F112%2F4%2F5.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F112%2F4%2F5.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/535/112/4/5.gif?puid=FB8DEA6F85BCB898&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=c522ed6f-4218-494d-9ed7-6f4d15b0c678&ttl=%%TTL%%
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F429%2F2%2F7.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/535/429/2/7.gif?puid=96C43014-E939-462B-9840-FD6252648723&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/535/2/1/8.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/535/2/1/8.gif?puid=6970583706083711862&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=RkI4REVBNkY4NUJDQjg5OA%3D%3D&gdpr=0&gdpr_consent=&id5=ID5-0abeSQQxDCY8tbZwXV-YnejPnLGgpaJy4VKIZIDbAQ
https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEOavI7Sd465fPZSEDIjssOk&sInitiator=internal&google_cver=1&gdpr=0&gdpr_consent=&id5=ID5-0abeSQQxDCY8tbZwXV-YnejPnLGgpaJy4VKIZIDbAQ&...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8

70 B
455 B

39ms
38ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:10 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 17 Nov 2023 15:38:10 GMT
Frontend-ID: 15
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Length: 0
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/
Redirect Chain

https://bh.contextweb.com/visitormatch/prebid
https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=%%ENCRYPTED_VGUID_B64%%&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEM4pumymxbWzKYGmu8OrYuo&google_cver=1

49 B
788 B

34ms
34ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEM4pumymxbWzKYGmu8OrYuo&google_cver=1

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-6b57df6cd5-g7bvx
expires: -1

Redirect headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEM4pumymxbWzKYGmu8OrYuo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 384
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame AD24 0
128 B 84ms
83ms Script
text/plain 104.36.113.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156423&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:08 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame AD24 2 KB
3 KB 33ms
32ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=9562556&p=156423&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 2af30a090f30166b9b3c9be5e6a926a0b89a03301d89f2f93a58cb4c16d0c0a9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 17 Nov 2023 15:38:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 74CD
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
74 B

28ms
28ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:11 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Fri, 17 Nov 2023 15:38:10 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 341D 43 B
360 B 3120ms
56ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Fri, 17 Nov 2023 15:38:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame CD09
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:17c76557-88de-4a00-9657-b2aa8110b950&gdpr=0&gdpr_consent=

42 B
290 B

28ms
28ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:17c76557-88de-4a00-9657-b2aa8110b950&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 17 Nov 2023 15:38:10 GMT
Expires: Fri, 17 Nov 2023 15:38:09 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1075 283b7e3 master iad iad-pixel-x18 config_version:"455"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:17c76557-88de-4a00-9657-b2aa8110b950&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 3308
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=rVdnjSuVAKS2BpLA5ohXZQ

42 B
280 B

84ms
84ms

Document
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=rVdnjSuVAKS2BpLA5ohXZQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:14 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=rVdnjSuVAKS2BpLA5ohXZQ
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3002
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6217121328
https://sync.1rx.io/usersync/tradedesk/c522ed6f-4218-494d-9ed7-6f4d15b0c678
https://sync.targeting.unrulymedia.com/csync/RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005

42 B
335 B

30ms
29ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Fri, 17 Nov 2023 15:38:10 GMT
ETag: RXf3acbfb2cb564e6187235561ebafd99e005
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-f3acbfb2-cb56-4e61-8723-5561ebafd99e-005
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding: chunked

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame 62D1 0
0 637ms
122ms Document
text/plain 162.55.120.196
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.55.120.196 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

nginx/1.23.3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Fri, 17 Nov 2023 15:38:11 GMT
Server: nginx/1.23.3
Strict-Transport-Security: max-age=15768000

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame B52B 43 B
276 B 1525ms
133ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Fri, 17 Nov 2023 15:38:12 GMT
Vary: Accept-Encoding
X-adserver-worker: molok-df8a6e34dcaa@version_1.576
X-core-time: 0ms
X-server-arch: v2

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 06D2
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7535218932082020952&uid=Q753521893208202...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7535218932082020952

42 B
95 B

30ms
30ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7535218932082020952
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=74216
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Fri, 17 Nov 2023 15:38:14 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7535218932082020952
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E4E3
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:E9C20F352A324C9F8DAC0B2EE1A416BC&gdpr=0&gdpr_consent=

1 B
53 B

29ms
28ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:E9C20F352A324C9F8DAC0B2EE1A416BC&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Fri, 17 Nov 2023 15:38:13 GMT
expires: Thu, 16 Nov 2023 15:38:13 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:E9C20F352A324C9F8DAC0B2EE1A416BC&gdpr=0&gdpr_consent=
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H3 200 match Show response
events-ssc.33across.com/ Frame 5CB4 68 B
82 B 40ms
40ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=96C43014-E939-462B-9840-FD6252648723
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Fri, 17 Nov 2023 15:38:10 GMT
via: 1.1 google

GET
H2

200

insync
thrtle.com/ Frame AD24
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=96C43014-E939-462B-9840-FD6252648723&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=96C43014-E939-462B-9840-FD6252648723&vxii_pid=12&vxii_pid1=10067&vxii_rcid=4f8502ea-f4b7-4317-b484-6ebe7e35c483

43 B
295 B

36ms
36ms

Image
image/gif

54.88.46.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=96C43014-E939-462B-9840-FD6252648723&vxii_pid=12&vxii_pid1=10067&vxii_rcid=4f8502ea-f4b7-4317-b484-6ebe7e35c483
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 54.88.46.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-88-46-163.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Fri, 17 Nov 2023 15:38:13 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=96C43014-E939-462B-9840-FD6252648723&vxii_pid=12&vxii_pid1=10067&vxii_rcid=4f8502ea-f4b7-4317-b484-6ebe7e35c483
date: Fri, 17 Nov 2023 15:38:13 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2 200 sd
us-u.openx.net/w/1.0/ Frame AD24 43 B
172 B 59ms
55ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=96C43014-E939-462B-9840-FD6252648723&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:10 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 Martin
crb.kargo.com/api/v1/dsync/ Frame AD24 43 B
359 B 1120ms
35ms Image
image/gif 44.194.237.174
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=96C43014-E939-462B-9840-FD6252648723&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.237.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-237-174.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:11 GMT
x-accel-expires: 0
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame AD24 0
425 B 392ms
34ms Image
text/plain 52.4.14.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=96C43014-E939-462B-9840-FD6252648723&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.14.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-14-82.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Connection: keep-alive
Date: Fri, 17 Nov 2023 15:38:11 GMT

GET
H2 200 apn
ads.playground.xyz/usersync/ Frame AD24 43 B
260 B 83ms
40ms Image
image/gif 34.102.253.54
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.253.54 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 54.253.102.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:12 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-request-id: 44c150e9-138c-421d-8b50-0893297a60de

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AD24
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:9005c2c4-acc7-4bb2-911a-723b18756bf0&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

28ms
28ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:9005c2c4-acc7-4bb2-911a-723b18756bf0&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 17 Nov 2023 15:38:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:9005c2c4-acc7-4bb2-911a-723b18756bf0&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Fri, 17 Nov 2023 15:38:12 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2 200 if Show response
lax1-ib.adnxs.com/ Frame 6338 9 KB
6 KB 115ms
113ms Document
text/html 104.254.151.69
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKBOPBMARwAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmNzBlMmFhNS03Njc4LTQzNWItOGYyMC1iY2QwOTVjZTQ4MWHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTU0MzkzNjkyN_ICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO3ZhciBsPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bmN0aW9uKGEsYyl7cmV0dXJuIEFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoYSxjLHZvaWQgMCl9OmZ1bmN0aW9uKGEsYyl7aWYoInN0cmluZyI9PT10eXBlb2YgYSlyZXR1cm4ic3RyaW5nIiE9PXR5cGVvZiBjfHwxIT1jLmxlbmd0aD8tMTphLmluZGV4T2YoYywwKTtmb3IodmFyIGU9MDtlPGEubGVuZ3RoO2UrKylpZihlIGluIGEmJmFbZV09PT1jKXJldHVybiBlO3JldHVybi0xfTtmdW5jdGlvbiBtKGEpe21bIiAiXShhKTtyZXR1cm4gYX1tWyIgIl09ZnVuYy2VBH07EdV0IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7EUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJTIIZSl7IZoUYj0hMTtiGVKAYj8hMTpiO2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7AVEUZD1uKGEuEZcQKTtpZigNawRmPRHICCgpexkXBGc9WlMARCxoPWwoZyxkKTswPD1oJiZBcjYFAiRzcGxpY2UuY2FsASdsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAMGImJihkLmF0dHJpYnVBHhRTcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BMcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3RhYAB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXeDGE9Yy6J1nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWshKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRh0KCksYz1h8X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAkMDw9Yz9hLnN1YhZaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CX0dxRXI1M0pMQktYUmtNdW0wOEkzb25JS2c0VTRIS19iNjlJQ0F1dDRITXN0d1FKZy1hc3VnZHBSN1VVdm8yRk90am90T0ZVT0NSVDVQVkttb2VjaVRYaFZEMkxnbkxFanhyU0J5MkpORFA5aWx0VSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS98ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaLwwIiQE8KX82HQEWJQpQYWRzLmcuZG91YmxlY2xpY2submV0MRs8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dORwge3IzcHgoJya7DBwnKTt9KSgpO10AEOoWChBIAZ40UE9SVF9QQVJBTVMS1RaROYqVAPCkYWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTA1Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9YW55ZmlsZS1uPiMOECZzdWJfDZUAYkGx8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUZrWHRBQkJIYlFBakljMEFjT05OQUYwa1RRQjRaSTBBWkdUTkFFTGxEUUJVWlEwQWNpVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBVS1XTkFGd2xqUUJkSlkwQVhhV05BRjgBECxnNVkwQVk2V05BR1IBEBhvSlkwQWFpARAAcgEQCHJaWQGAEFdOQUhTARAAMwEgAGUFEABtARAYNnBZMEFldQEgADQBEEBBWmMwQVFxWE5BRXdselFCTwEQGFVDWE5BRkIBEBhRcGMwQVVlARAAUQEQFFU1YzBBVwUg9EkETGMwRUJVM05CQVZoelFRRmFQTm9CSDRRSEFuOGVYQUphLVlnQzVmMklBaWRDcWdJN1dxb0NJMjZxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xGdGFvQzhfV3FBbW40cWdJbS02b0NRZnVxQWxFTHF3SThJNnNDaENlckFsUW9xd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQW1JN3F3SzFQS3NDQWotckFteEtxd0pSVGFzQ3dFMnJBbUJPcXdLNFRxc0M5RkNyQWdKUnF3SUtVYXNDaTF1ckFpQmNxd0lXWXFzQzVHU3JBc05ucXdJUGFxc0NHWEdyQXRkeHF3THhjYXNDc0hLckFvQnpxd0xNZEtzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDVTRDckFyaUFxd0tiZ2FzQ040S3JBbktIcXdLNWg2c0NvSXFyQXNpTHF3SUFqS3NDc295ckFyYU1xd0s0aktzQ0FwQ3JBdWFScXdJWWxhc0NISmFyQWxDWHF3TEdsNnNDREppckFnNmFxd0xybmFzQ01aNnJBc1dlcXdMT25xc0NBNS1yQXZPZnF3TFZvYXNDNzZHckFqV2lxd0tWbzZzQ3FxT3JBdHFrcXdMcHBxc0NNYWlyQWdDcHF3S2lxYXNDMmFtckF2eXBxd0lkcXFzQzI2dXJBbHF0cXdJVnJxc0NKYTZyQWtLdXF3SkVycXNDYzY2ckF1Q3Vxd0k3cjZzQ2c2LXJBcC12cXdJSnNhc0NGckdyQW5XeHF3S3JzYXNDWXJLckFudXpxd0tzczZzQ0ZyU3JBaHEwcXdJaHRLc0NKYlNyQWltMHF3STZ0S3NDaHJTckFnbTFxd0lGdHFzQ0o3YXJBdXUycXdJV3Q2c0NKYmVyQWoyM3F3S0t0NnNDYXJpckFwRzRxd0xhdUtzQzc3aXJBaUs1cXdJcXVhc0MtYm1yQWlPN3F3SW11NnNDTWJ1ckF1cTdxd0xCYkNRRXNGMzNCSVcweFFXdHptVU9XYlg3RWxuSy14S1Q2dnNTTEE3OEVyUU9fQkpXRF93U3JSTDhFcTRUX0JKaUdQd1NlQmo4RXN3Wl9CSmtHX3dTd3h2OEV1a2JfQklNSGZ3U09SMzhFdWNkX0JMcEhmd1NaMTNRRTFaZHl5Ylc4RmtveXN1MUxnJmV4az0xNTQzOTM2OTI3JmF3YmlkX2M9QUtBbWYtREJUWU1RVEQzOWJfMHN0VXpxOXgxNzdmNEJJaHk4ZFJwNl9zbHBBcksxQVFYaDVJZXVFQWNjLUhSc1VnSDN3ZThCSXg1bERIV0NBT2ZxeGZ5ODgyYXhuaGJuMnJjcloyOGZwWW9SLS1sMm9aNjBYNURvWG92WHdxMFhFallOcHFxOVdkMVZhLWh1b2VSSkMxbEpLdGtILVZ0ajJkN1pZc3lPMzFvcTVjci1rcktCLWRr7b0AZO299CsFQWRUZGQ2RThQR0xOM1NZSldXU2F4b0UydnlaX1pMUlJEazNLMzlxa3FZcUpDVWdMaXRPdmkwbHRVNzhfeGpYWjFwVUZNc1ppMXFFa0RwV3F4RVFLdHNMMHFVNExzSmM5ajBNWV9weXZiTEFGQVJ4RHpzR0hlRGJqZzVFX01oVTNocDFvXy1WQXZhMWF5djJxTkE2WnFEYUtqVy1tNnJyVWZoYWhHT3JaNkVxcmlObHVUeWt1VzlnV3VjVUpQd3l5bEN1NEJaMldYaWRFSGZlWXotcU5GUXpwTEl4emQ0MUhrQmh3SHlnWk5vN0FXSnhldzdPVlBuaTlDQ3FQVTFYV24wTEhrWlFsdk5EbUs0Vnc1bzFCRDBjZDVPWnV6TjRJLXktQS1ydWJPeFBjaFVXWHo5MXR6SU13ZDNDeWFoVW5JYmdKdHBaMEhQSXdPTVVzaUJnTjNTbnllalZmSFM1aEtXRzRCWDF1S01MNExrcjg1aDFZNlZQTUdNVUQ2STNsUkpGRE1rWmliQTZrS0d0XzBfV250QjhDWmV6T3E4ak51WVluU09vN2kyMV9GUU41QmJLNWtDSDNGbGgyVjlsTkVXbEJsNmRNaEFuWUhEWGNrdmlhT1lqRlRMSGZIOXE5Ti1DOS1mN0pCNG5pdVdHaXllVmVHNUVGV2ZtMFVwU1VSQmVtWVhScEtiQ3JWZTZndFV6bll3dDZONWdKTFZzU1RvVWhlUmR2WVFzclhFZWc0WV9WZGFHY0Z5S3FWdUZzdXVtMzh1UjI3Vk1XcjZiSkZQR3pTUjEyN1pwZVg4RllDakdLNGRVQXp4emZtMzdrdlRRV2VyN0I1bmcxQXNNX2M5NmRhVVNRVEJ3VWJpaUFrQmhQUFh2bEZRMnkzbWZYQVhTNTBpaGJySm9YWjJsbUowWDR3ZDZFRFJWc25PLWZ4YW55dExRN3NwdHk5VHlqOE82em9DMVdOSTVVc095V056VXpnNk80NFhLRHo0MmFPMERUUU45UHlnR3loUVBrNFRHUzZZTXYwOWxSUDVsS29jRVlGbFdlU1NhYU4wR2V3NHNIdmpiUzhPN1RUTW4wdFJQY2J3X0ZDRFJRTnB3ZTFTU0RlREEwUkdYS1pZWkoyUEZPOUJveWZFNldTV2JiZm1JYWJXNmdfQXA1RXdRMVpGM3RsejFjZmRPSWJkRzlTMmg1RndpajJPYzlOWGFSU3RuZG1ibFBPc3RXaUtZNlEyYkh1c0FIT083SHVKRVZoTE9CUDl6WGt5VTRIdmlCN0h3aDN6TjlicE5DLV8wbm9Bd0xLWmpRU0RLM1hGY3BFZkZzV1h5T2doR0V6YUoyOWpZNjAwNnVRRmVpWUNXRUtpTDhuelE5U0ozTXlOMkdhZVZIR3Etc2E2V25zRUxvYWhlQ1N4Mlc0cG9nNC04eWhrcm9Wdk5zSlJtMHRfd01CZHllZzB2VldvM3BVbERnNzczSXRzQnZKa0pabHBhME1FdjdOaWNxaG5FT0ZJUjhTY3FCcEw0R0huMFRnVEVEa004cmRxd1piN3Vsa2xjdFE5SVllUnViSmk2c1BBWWVrbnp4aEVMNmRiUFZGSHVzbVNQMTVhY00yQXZWUTNBRXplMTVqcSZjaWQ9Q0FRU0d3RElDYWFOU2FrRWlDUS1WLW91aF9zRUdzdnFNT1FrQW1RUmVSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP7AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeSJ2D64dDfSOATJ0RUYxSUNoVXRYczhNMjlwTjVKQnZhMnJudDdrQW4wbGdXdC0xeUVVTXljQ3dLZ01JREtSY2UtZTNoY1JvRGVQZU9pbzVXd1hmTnNrdjhVMlZmWXZ1X3dUSEU0VTNhRmk0bjUyY0dwVFhxSzRiN0kmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSMzI3NzkzOTk4MDI0OTU2MjU4Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4xOS4yMTIuMTA1qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYyShuPS44T7bKoFKjg0Y2VjMGFlLTg0NmUtNGUzMy05ZjlmLTY3OTIxOGJmNzcyZn4zMjR-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEBIvGx0BsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHuO8F0gcNCRE4ATUI2gcGCfWo4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=775780ea6a9971de63f3a71de6ffa2d417e38a4c

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKBOPBMARwAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmNzBlMmFhNS03Njc4LTQzNWItOGYyMC1iY2QwOTVjZTQ4MWHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTU0MzkzNjkyN_ICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO3ZhciBsPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bmN0aW9uKGEsYyl7cmV0dXJuIEFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoYSxjLHZvaWQgMCl9OmZ1bmN0aW9uKGEsYyl7aWYoInN0cmluZyI9PT10eXBlb2YgYSlyZXR1cm4ic3RyaW5nIiE9PXR5cGVvZiBjfHwxIT1jLmxlbmd0aD8tMTphLmluZGV4T2YoYywwKTtmb3IodmFyIGU9MDtlPGEubGVuZ3RoO2UrKylpZihlIGluIGEmJmFbZV09PT1jKXJldHVybiBlO3JldHVybi0xfTtmdW5jdGlvbiBtKGEpe21bIiAiXShhKTtyZXR1cm4gYX1tWyIgIl09ZnVuYy2VBH07EdV0IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7EUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJTIIZSl7IZoUYj0hMTtiGVKAYj8hMTpiO2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7AVEUZD1uKGEuEZcQKTtpZigNawRmPRHICCgpexkXBGc9WlMARCxoPWwoZyxkKTswPD1oJiZBcjYFAiRzcGxpY2UuY2FsASdsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAMGImJihkLmF0dHJpYnVBHhRTcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BMcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3RhYAB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXeDGE9Yy6J1nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWshKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRh0KCksYz1h8X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAkMDw9Yz9hLnN1YhZaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CX0dxRXI1M0pMQktYUmtNdW0wOEkzb25JS2c0VTRIS19iNjlJQ0F1dDRITXN0d1FKZy1hc3VnZHBSN1VVdm8yRk90am90T0ZVT0NSVDVQVkttb2VjaVRYaFZEMkxnbkxFanhyU0J5MkpORFA5aWx0VSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS98ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaLwwIiQE8KX82HQEWJQpQYWRzLmcuZG91YmxlY2xpY2submV0MRs8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dORwge3IzcHgoJya7DBwnKTt9KSgpO10AEOoWChBIAZ40UE9SVF9QQVJBTVMS1RaROYqVAPCkYWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTA1Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9YW55ZmlsZS1uPiMOECZzdWJfDZUAYkGx8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUZrWHRBQkJIYlFBakljMEFjT05OQUYwa1RRQjRaSTBBWkdUTkFFTGxEUUJVWlEwQWNpVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBVS1XTkFGd2xqUUJkSlkwQVhhV05BRjgBECxnNVkwQVk2V05BR1IBEBhvSlkwQWFpARAAcgEQCHJaWQGAEFdOQUhTARAAMwEgAGUFEABtARAYNnBZMEFldQEgADQBEEBBWmMwQVFxWE5BRXdselFCTwEQGFVDWE5BRkIBEBhRcGMwQVVlARAAUQEQFFU1YzBBVwUg9EkETGMwRUJVM05CQVZoelFRRmFQTm9CSDRRSEFuOGVYQUphLVlnQzVmMklBaWRDcWdJN1dxb0NJMjZxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xGdGFvQzhfV3FBbW40cWdJbS02b0NRZnVxQWxFTHF3SThJNnNDaENlckFsUW9xd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQW1JN3F3SzFQS3NDQWotckFteEtxd0pSVGFzQ3dFMnJBbUJPcXdLNFRxc0M5RkNyQWdKUnF3SUtVYXNDaTF1ckFpQmNxd0lXWXFzQzVHU3JBc05ucXdJUGFxc0NHWEdyQXRkeHF3THhjYXNDc0hLckFvQnpxd0xNZEtzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDVTRDckFyaUFxd0tiZ2FzQ040S3JBbktIcXdLNWg2c0NvSXFyQXNpTHF3SUFqS3NDc295ckFyYU1xd0s0aktzQ0FwQ3JBdWFScXdJWWxhc0NISmFyQWxDWHF3TEdsNnNDREppckFnNmFxd0xybmFzQ01aNnJBc1dlcXdMT25xc0NBNS1yQXZPZnF3TFZvYXNDNzZHckFqV2lxd0tWbzZzQ3FxT3JBdHFrcXdMcHBxc0NNYWlyQWdDcHF3S2lxYXNDMmFtckF2eXBxd0lkcXFzQzI2dXJBbHF0cXdJVnJxc0NKYTZyQWtLdXF3SkVycXNDYzY2ckF1Q3Vxd0k3cjZzQ2c2LXJBcC12cXdJSnNhc0NGckdyQW5XeHF3S3JzYXNDWXJLckFudXpxd0tzczZzQ0ZyU3JBaHEwcXdJaHRLc0NKYlNyQWltMHF3STZ0S3NDaHJTckFnbTFxd0lGdHFzQ0o3YXJBdXUycXdJV3Q2c0NKYmVyQWoyM3F3S0t0NnNDYXJpckFwRzRxd0xhdUtzQzc3aXJBaUs1cXdJcXVhc0MtYm1yQWlPN3F3SW11NnNDTWJ1ckF1cTdxd0xCYkNRRXNGMzNCSVcweFFXdHptVU9XYlg3RWxuSy14S1Q2dnNTTEE3OEVyUU9fQkpXRF93U3JSTDhFcTRUX0JKaUdQd1NlQmo4RXN3Wl9CSmtHX3dTd3h2OEV1a2JfQklNSGZ3U09SMzhFdWNkX0JMcEhmd1NaMTNRRTFaZHl5Ylc4RmtveXN1MUxnJmV4az0xNTQzOTM2OTI3JmF3YmlkX2M9QUtBbWYtREJUWU1RVEQzOWJfMHN0VXpxOXgxNzdmNEJJaHk4ZFJwNl9zbHBBcksxQVFYaDVJZXVFQWNjLUhSc1VnSDN3ZThCSXg1bERIV0NBT2ZxeGZ5ODgyYXhuaGJuMnJjcloyOGZwWW9SLS1sMm9aNjBYNURvWG92WHdxMFhFallOcHFxOVdkMVZhLWh1b2VSSkMxbEpLdGtILVZ0ajJkN1pZc3lPMzFvcTVjci1rcktCLWRr7b0AZO299CsFQWRUZGQ2RThQR0xOM1NZSldXU2F4b0UydnlaX1pMUlJEazNLMzlxa3FZcUpDVWdMaXRPdmkwbHRVNzhfeGpYWjFwVUZNc1ppMXFFa0RwV3F4RVFLdHNMMHFVNExzSmM5ajBNWV9weXZiTEFGQVJ4RHpzR0hlRGJqZzVFX01oVTNocDFvXy1WQXZhMWF5djJxTkE2WnFEYUtqVy1tNnJyVWZoYWhHT3JaNkVxcmlObHVUeWt1VzlnV3VjVUpQd3l5bEN1NEJaMldYaWRFSGZlWXotcU5GUXpwTEl4emQ0MUhrQmh3SHlnWk5vN0FXSnhldzdPVlBuaTlDQ3FQVTFYV24wTEhrWlFsdk5EbUs0Vnc1bzFCRDBjZDVPWnV6TjRJLXktQS1ydWJPeFBjaFVXWHo5MXR6SU13ZDNDeWFoVW5JYmdKdHBaMEhQSXdPTVVzaUJnTjNTbnllalZmSFM1aEtXRzRCWDF1S01MNExrcjg1aDFZNlZQTUdNVUQ2STNsUkpGRE1rWmliQTZrS0d0XzBfV250QjhDWmV6T3E4ak51WVluU09vN2kyMV9GUU41QmJLNWtDSDNGbGgyVjlsTkVXbEJsNmRNaEFuWUhEWGNrdmlhT1lqRlRMSGZIOXE5Ti1DOS1mN0pCNG5pdVdHaXllVmVHNUVGV2ZtMFVwU1VSQmVtWVhScEtiQ3JWZTZndFV6bll3dDZONWdKTFZzU1RvVWhlUmR2WVFzclhFZWc0WV9WZGFHY0Z5S3FWdUZzdXVtMzh1UjI3Vk1XcjZiSkZQR3pTUjEyN1pwZVg4RllDakdLNGRVQXp4emZtMzdrdlRRV2VyN0I1bmcxQXNNX2M5NmRhVVNRVEJ3VWJpaUFrQmhQUFh2bEZRMnkzbWZYQVhTNTBpaGJySm9YWjJsbUowWDR3ZDZFRFJWc25PLWZ4YW55dExRN3NwdHk5VHlqOE82em9DMVdOSTVVc095V056VXpnNk80NFhLRHo0MmFPMERUUU45UHlnR3loUVBrNFRHUzZZTXYwOWxSUDVsS29jRVlGbFdlU1NhYU4wR2V3NHNIdmpiUzhPN1RUTW4wdFJQY2J3X0ZDRFJRTnB3ZTFTU0RlREEwUkdYS1pZWkoyUEZPOUJveWZFNldTV2JiZm1JYWJXNmdfQXA1RXdRMVpGM3RsejFjZmRPSWJkRzlTMmg1RndpajJPYzlOWGFSU3RuZG1ibFBPc3RXaUtZNlEyYkh1c0FIT083SHVKRVZoTE9CUDl6WGt5VTRIdmlCN0h3aDN6TjlicE5DLV8wbm9Bd0xLWmpRU0RLM1hGY3BFZkZzV1h5T2doR0V6YUoyOWpZNjAwNnVRRmVpWUNXRUtpTDhuelE5U0ozTXlOMkdhZVZIR3Etc2E2V25zRUxvYWhlQ1N4Mlc0cG9nNC04eWhrcm9Wdk5zSlJtMHRfd01CZHllZzB2VldvM3BVbERnNzczSXRzQnZKa0pabHBhME1FdjdOaWNxaG5FT0ZJUjhTY3FCcEw0R0huMFRnVEVEa004cmRxd1piN3Vsa2xjdFE5SVllUnViSmk2c1BBWWVrbnp4aEVMNmRiUFZGSHVzbVNQMTVhY00yQXZWUTNBRXplMTVqcSZjaWQ9Q0FRU0d3RElDYWFOU2FrRWlDUS1WLW91aF9zRUdzdnFNT1FrQW1RUmVSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP7AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeSJ2D64dDfSOATJ0RUYxSUNoVXRYczhNMjlwTjVKQnZhMnJudDdrQW4wbGdXdC0xeUVVTXljQ3dLZ01JREtSY2UtZTNoY1JvRGVQZU9pbzVXd1hmTnNrdjhVMlZmWXZ1X3dUSEU0VTNhRmk0bjUyY0dwVFhxSzRiN0kmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSMzI3NzkzOTk4MDI0OTU2MjU4Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4xOS4yMTIuMTA1qAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYyShuPS44T7bKoFKjg0Y2VjMGFlLTg0NmUtNGUzMy05ZjlmLTY3OTIxOGJmNzcyZn4zMjR-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEBIvGx0BsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHuO8F0gcNCRE4ATUI2gcGCfWo4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=347b985e8351805de5126c68884ae3bed7521f6c&pp=41.44003

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.69 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

94327fb4842c8c67d73b08a58a178e602f9d4c079628ae92217a68d3fc271103

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 4694c91f-aef7-4cf5-99b7-fde24b41a9b6
cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 17 Nov 2023 15:38:10 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
vary: Accept-Encoding
x-creative-id: 77221793
x-proxy-origin: 37.19.212.105; 37.19.212.105; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 19FD 52 KB
17 KB 1328ms
22ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKBOPBMARwAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmNzBlMmFhNS03Njc4LTQzNWItOGYyMC1iY2QwOTVjZTQ4MWHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTU0MzkzNjkyN_ICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO3ZhciBsPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bmN0aW9uKGEsYyl7cmV0dXJuIEFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoYSxjLHZvaWQgMCl9OmZ1bmN0aW9uKGEsYyl7aWYoInN0cmluZyI9PT10eXBlb2YgYSlyZXR1cm4ic3RyaW5nIiE9PXR5cGVvZiBjfHwxIT1jLmxlbmd0aD8tMTphLmluZGV4T2YoYywwKTtmb3IodmFyIGU9MDtlPGEubGVuZ3RoO2UrKylpZihlIGluIGEmJmFbZV09PT1jKXJldHVybiBlO3JldHVybi0xfTtmdW5jdGlvbiBtKGEpe21bIiAiXShhKTtyZXR1cm4gYX1tWyIgIl09ZnVuYy2VBH07EdV0IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7EUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJTIIZSl7IZoUYj0hMTtiGVKAYj8hMTpiO2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7AVEUZD1uKGEuEZcQKTtpZigNawRmPRHICCgpexkXBGc9WlMARCxoPWwoZyxkKTswPD1oJiZBcjYFAiRzcGxpY2UuY2FsASdsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAMGImJihkLmF0dHJpYnVBHhRTcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BMcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3RhYAB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXeDGE9Yy6J1nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWshKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRh0KCksYz1h8X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAkMDw9Yz9hLnN1YhZaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CX0dxRXI1M0pMQktYUmtNdW0wOEkzb25JS2c0VTRIS19iNjlJQ0F1dDRITXN0d1FKZy1hc3VnZHBSN1VVdm8yRk90am90T0ZVT0NSVDVQVkttb2VjaVRYaFZEMkxnbkxFanhyU0J5MkpORFA5aWx0VSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS98ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaLwwIiQE8KX82HQEWJQpQYWRzLmcuZG91YmxlY2xpY2submV0MRs8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dORwge3IzcHgoJya7DBwnKTt9KSgpO10AEOoWChBIAZ40UE9SVF9QQVJBTVMS1RaROYqVAPCkYWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTA1Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9YW55ZmlsZS1uPiMOECZzdWJfDZUAYkGx8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUZrWHRBQkJIYlFBakljMEFjT05OQUYwa1RRQjRaSTBBWkdUTkFFTGxEUUJVWlEwQWNpVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBVS1XTkFGd2xqUUJkSlkwQVhhV05BRjgBECxnNVkwQVk2V05BR1IBEBhvSlkwQWFpARAAcgEQCHJaWQGAEFdOQUhTARAAMwEgAGUFEABtARAYNnBZMEFldQEgADQBEEBBWmMwQVFxWE5BRXdselFCTwEQGFVDWE5BRkIBEBhRcGMwQVVlARAAUQEQFFU1YzBBVwUg9EkETGMwRUJVM05CQVZoelFRRmFQTm9CSDRRSEFuOGVYQUphLVlnQzVmMklBaWRDcWdJN1dxb0NJMjZxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xGdGFvQzhfV3FBbW40cWdJbS02b0NRZnVxQWxFTHF3SThJNnNDaENlckFsUW9xd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQW1JN3F3SzFQS3NDQWotckFteEtxd0pSVGFzQ3dFMnJBbUJPcXdLNFRxc0M5RkNyQWdKUnF3SUtVYXNDaTF1ckFpQmNxd0lXWXFzQzVHU3JBc05ucXdJUGFxc0NHWEdyQXRkeHF3THhjYXNDc0hLckFvQnpxd0xNZEtzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDVTRDckFyaUFxd0tiZ2FzQ040S3JBbktIcXdLNWg2c0NvSXFyQXNpTHF3SUFqS3NDc295ckFyYU1xd0s0aktzQ0FwQ3JBdWFScXdJWWxhc0NISmFyQWxDWHF3TEdsNnNDREppckFnNmFxd0xybmFzQ01aNnJBc1dlcXdMT25xc0NBNS1yQXZPZnF3TFZvYXNDNzZHckFqV2lxd0tWbzZzQ3FxT3JBdHFrcXdMcHBxc0NNYWlyQWdDcHF3S2lxYXNDMmFtckF2eXBxd0lkcXFzQzI2dXJBbHF0cXdJVnJxc0NKYTZyQWtLdXF3SkVycXNDYzY2ckF1Q3Vxd0k3cjZzQ2c2LXJBcC12cXdJSnNhc0NGckdyQW5XeHF3S3JzYXNDWXJLckFudXpxd0tzczZzQ0ZyU3JBaHEwcXdJaHRLc0NKYlNyQWltMHF3STZ0S3NDaHJTckFnbTFxd0lGdHFzQ0o3YXJBdXUycXdJV3Q2c0NKYmVyQWoyM3F3S0t0NnNDYXJpckFwRzRxd0xhdUtzQzc3aXJBaUs1cXdJcXVhc0MtYm1yQWlPN3F3SW11NnNDTWJ1ckF1cTdxd0xCYkNRRXNGMzNCSVcweFFXdHptVU9XYlg3RWxuSy14S1Q2dnNTTEE3OEVyUU9fQkpXRF93U3JSTDhFcTRUX0JKaUdQd1NlQmo4RXN3Wl9CSmtHX3dTd3h2OEV1a2JfQklNSGZ3U09SMzhFdWNkX0JMcEhmd1NaMTNRRTFaZHl5Ylc4RmtveXN1MUxnJmV4az0xNTQzOTM2OTI3JmF3YmlkX2M9QUtBbWYtREJUWU1RVEQzOWJfMHN0VXpxOXgxNzdmNEJJaHk4ZFJwNl9zbHBBcksxQVFYaDVJZXVFQWNjLUhSc1VnSDN3ZThCSXg1bERIV0NBT2ZxeGZ5ODgyYXhuaGJuMnJjcloyOGZwWW9SLS1sMm9aNjBYNURvWG92WHdxMFhFallOcHFxOVdkMVZhLWh1b2VSSkMxbEpLdGtILVZ0ajJkN1pZc3lPMzFvcTVjci1rcktCLWRr7b0AZO299CsFQWRUZGQ2RThQR0xOM1NZSldXU2F4b0UydnlaX1pMUlJEazNLMzlxa3FZcUpDVWdMaXRPdmkwbHRVNzhfeGpYWjFwVUZNc1ppMXFFa0RwV3F4RVFLdHNMMHFVNExzSmM5ajBNWV9weXZiTEFGQVJ4RHpzR0hlRGJqZzVFX01oVTNocDFvXy1WQXZhMWF5djJxTkE2WnFEYUtqVy1tNnJyVWZoYWhHT3JaNkVxcmlObHVUeWt1VzlnV3VjVUpQd3l5bEN1NEJaMldYaWRFSGZlWXotcU5GUXpwTEl4emQ0MUhrQmh3SHlnWk5vN0FXSnhldzdPVlBuaTlDQ3FQVTFYV24wTEhrWlFsdk5EbUs0Vnc1bzFCRDBjZDVPWnV6TjRJLXktQS1ydWJPeFBjaFVXWHo5MXR6SU13ZDNDeWFoVW5JYmdKdHBaMEhQSXdPTVVzaUJnTjNTbnllalZmSFM1aEtXRzRCWDF1S01MNExrcjg1aDFZNlZQTUdNVUQ2STNsUkpGRE1rWmliQTZrS0d0XzBfV250QjhDWmV6T3E4ak51WVluU09vN2kyMV9GUU41QmJLNWtDSDNGbGgyVjlsTkVXbEJsNmRNaEFuWUhEWGNrdmlhT1lqRlRMSGZIOXE5Ti1DOS1mN0pCNG5pdVdHaXllVmVHNUVGV2ZtMFVwU1VSQmVtWVhScEtiQ3JWZTZndFV6bll3dDZONWdKTFZzU1RvVWhlUmR2WVFzclhFZWc0WV9WZGFHY0Z5S3FWdUZzdXVtMzh1UjI3Vk1XcjZiSkZQR3pTUjEyN1pwZVg4RllDakdLNGRVQXp4emZtMzdrdlRRV2VyN0I1bmcxQXNNX2M5NmRhVVNRVEJ3VWJpaUFrQmhQUFh2bEZRMnkzbWZYQVhTNTBpaGJySm9YWjJsbUowWDR3ZDZFRFJWc25PLWZ4YW55dExRN3NwdHk5VHlqOE82em9DMVdOSTVVc095V056VXpnNk80NFhLRHo0MmFPMERUUU45UHlnR3loUVBrNFRHUzZZTXYwOWxSUDVsS29jRVlGbFdlU1NhYU4wR2V3NHNIdmpiUzhPN1RUTW4wdFJQY2J3X0ZDRFJRTnB3ZTFTU0RlREEwUkdYS1pZWkoyUEZPOUJveWZFNldTV2JiZm1JYWJXNmdfQXA1RXdRMVpGM3RsejFjZmRPSWJkRzlTMmg1RndpajJPYzlOWGFSU3RuZG1ibFBPc3RXaUtZNlEyYkh1c0FIT083SHVKRVZoTE9CUDl6WGt5VTRIdmlCN0h3aDN6TjlicE5DLV8wbm9Bd0xLWmpRU0RLM1hGY3BFZkZzV1h5T2doR0V6YUoyOWpZNjAwNnVRRmVpWUNXRUtpTDhuelE5U0ozTXlOMkdhZVZIR3Etc2E2V25zRUxvYWhlQ1N4Mlc0cG9nNC04eWhrcm9Wdk5zSlJtMHRfd01CZHllZzB2VldvM3BVbERnNzczSXRzQnZKa0pabHBhME1FdjdOaWNxaG5FT0ZJUjhTY3FCcEw0R0huMFRnVEVEa004cmRxd1piN3Vsa2xjdFE5SVllUnViSmk2c1BBWWVrbnp4aEVMNmRiUFZGSHVzbVNQMTVhY00yQXZWUTNBRXplMTVqcSZjaWQ9Q0FRU0d3RElDYWFOU2FrRWlDUS1WLW91aF9zRUdzdnFNT1FrQW1RUmVSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP7AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeSJ2D64dDfSOATJ0RUYxSUNoVXRYczhNMjlwTjVKQnZhMnJudDdrQW4wbGdXdC0xeUVVTXljQ3dLZ01JREtSY2UtZTNoY1JvRGVQZU9pbzVXd1hmTnNrdjhVMlZmWXZ1X3dUSEU0VTNhRmk0bjUyY0dwVFhxSzRiN0kmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSMzI3NzkzOTk4MDI0OTU2MjU4Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4xOS4yMTIuMTA1qAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYyShuPS44T7bKoFKjg0Y2VjMGFlLTg0NmUtNGUzMy05ZjlmLTY3OTIxOGJmNzcyZn4zMjR-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEBIvGx0BsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHuO8F0gcNCRE4ATUI2gcGCfWo4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=347b985e8351805de5126c68884ae3bed7521f6c&pp=41.44003
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 25236
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 17 Nov 2023 15:38:12 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 455, 46542
X-Served-By: cache-lga13626-LGA, cache-yyz4531-YYZ
X-Timer: S1700235492.083636,VS0,VE0

GET
H2 200 rd_log Show response
lax1-ib.adnxs.com/ Frame 420F 0
646 B 108ms
107ms Script
text/html 104.254.151.69
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/rd_log?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKFNvBMBRsAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmNzBlMmFhNS03Njc4LTQzNWItOGYyMC1iY2QwOTVjZTQ4MWHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTU0MzkzNjkyN_ICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO3ZhciBsPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bmN0aW9uKGEsYyl7cmV0dXJuIEFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoYSxjLHZvaWQgMCl9OmZ1bmN0aW9uKGEsYyl7aWYoInN0cmluZyI9PT10eXBlb2YgYSlyZXR1cm4ic3RyaW5nIiE9PXR5cGVvZiBjfHwxIT1jLmxlbmd0aD8tMTphLmluZGV4T2YoYywwKTtmb3IodmFyIGU9MDtlPGEubGVuZ3RoO2UrKylpZihlIGluIGEmJmFbZV09PT1jKXJldHVybiBlO3JldHVybi0xfTtmdW5jdGlvbiBtKGEpe21bIiAiXShhKTtyZXR1cm4gYX1tWyIgIl09ZnVuYy2VBH07EdV0IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7EUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJTIIZSl7IZoUYj0hMTtiGVKAYj8hMTpiO2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7AVEUZD1uKGEuEZcQKTtpZigNawRmPRHICCgpexkXBGc9WlMARCxoPWwoZyxkKTswPD1oJiZBcjYFAiRzcGxpY2UuY2FsASdsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAMGImJihkLmF0dHJpYnVBHhRTcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BMcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3RhYAB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXeDGE9Yy6J1nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWshKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRh0KCksYz1h8X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAkMDw9Yz9hLnN1YhZaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CX0dxRXI1M0pMQktYUmtNdW0wOEkzb25JS2c0VTRIS19iNjlJQ0F1dDRITXN0d1FKZy1hc3VnZHBSN1VVdm8yRk90am90T0ZVT0NSVDVQVkttb2VjaVRYaFZEMkxnbkxFanhyU0J5MkpORFA5aWx0VSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS98ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaLwwIiQE8KX82HQEWJQpQYWRzLmcuZG91YmxlY2xpY2submV0MRs8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dORwge3IzcHgoJya7DBwnKTt9KSgpO10AEOoWChBIAZ40UE9SVF9QQVJBTVMS1RaROYqVAPCkYWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTA1Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9YW55ZmlsZS1uPiMOECZzdWJfDZUAYkGx8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUZrWHRBQkJIYlFBakljMEFjT05OQUYwa1RRQjRaSTBBWkdUTkFFTGxEUUJVWlEwQWNpVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBVS1XTkFGd2xqUUJkSlkwQVhhV05BRjgBECxnNVkwQVk2V05BR1IBEBhvSlkwQWFpARAAcgEQCHJaWQGAEFdOQUhTARAAMwEgAGUFEABtARAYNnBZMEFldQEgADQBEEBBWmMwQVFxWE5BRXdselFCTwEQGFVDWE5BRkIBEBhRcGMwQVVlARAAUQEQFFU1YzBBVwUg9EkETGMwRUJVM05CQVZoelFRRmFQTm9CSDRRSEFuOGVYQUphLVlnQzVmMklBaWRDcWdJN1dxb0NJMjZxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xGdGFvQzhfV3FBbW40cWdJbS02b0NRZnVxQWxFTHF3SThJNnNDaENlckFsUW9xd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQW1JN3F3SzFQS3NDQWotckFteEtxd0pSVGFzQ3dFMnJBbUJPcXdLNFRxc0M5RkNyQWdKUnF3SUtVYXNDaTF1ckFpQmNxd0lXWXFzQzVHU3JBc05ucXdJUGFxc0NHWEdyQXRkeHF3THhjYXNDc0hLckFvQnpxd0xNZEtzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDVTRDckFyaUFxd0tiZ2FzQ040S3JBbktIcXdLNWg2c0NvSXFyQXNpTHF3SUFqS3NDc295ckFyYU1xd0s0aktzQ0FwQ3JBdWFScXdJWWxhc0NISmFyQWxDWHF3TEdsNnNDREppckFnNmFxd0xybmFzQ01aNnJBc1dlcXdMT25xc0NBNS1yQXZPZnF3TFZvYXNDNzZHckFqV2lxd0tWbzZzQ3FxT3JBdHFrcXdMcHBxc0NNYWlyQWdDcHF3S2lxYXNDMmFtckF2eXBxd0lkcXFzQzI2dXJBbHF0cXdJVnJxc0NKYTZyQWtLdXF3SkVycXNDYzY2ckF1Q3Vxd0k3cjZzQ2c2LXJBcC12cXdJSnNhc0NGckdyQW5XeHF3S3JzYXNDWXJLckFudXpxd0tzczZzQ0ZyU3JBaHEwcXdJaHRLc0NKYlNyQWltMHF3STZ0S3NDaHJTckFnbTFxd0lGdHFzQ0o3YXJBdXUycXdJV3Q2c0NKYmVyQWoyM3F3S0t0NnNDYXJpckFwRzRxd0xhdUtzQzc3aXJBaUs1cXdJcXVhc0MtYm1yQWlPN3F3SW11NnNDTWJ1ckF1cTdxd0xCYkNRRXNGMzNCSVcweFFXdHptVU9XYlg3RWxuSy14S1Q2dnNTTEE3OEVyUU9fQkpXRF93U3JSTDhFcTRUX0JKaUdQd1NlQmo4RXN3Wl9CSmtHX3dTd3h2OEV1a2JfQklNSGZ3U09SMzhFdWNkX0JMcEhmd1NaMTNRRTFaZHl5Ylc4RmtveXN1MUxnJmV4az0xNTQzOTM2OTI3JmF3YmlkX2M9QUtBbWYtREJUWU1RVEQzOWJfMHN0VXpxOXgxNzdmNEJJaHk4ZFJwNl9zbHBBcksxQVFYaDVJZXVFQWNjLUhSc1VnSDN3ZThCSXg1bERIV0NBT2ZxeGZ5ODgyYXhuaGJuMnJjcloyOGZwWW9SLS1sMm9aNjBYNURvWG92WHdxMFhFallOcHFxOVdkMVZhLWh1b2VSSkMxbEpLdGtILVZ0ajJkN1pZc3lPMzFvcTVjci1rcktCLWRr7b0AZO299HAGQWRUZGQ2RThQR0xOM1NZSldXU2F4b0UydnlaX1pMUlJEazNLMzlxa3FZcUpDVWdMaXRPdmkwbHRVNzhfeGpYWjFwVUZNc1ppMXFFa0RwV3F4RVFLdHNMMHFVNExzSmM5ajBNWV9weXZiTEFGQVJ4RHpzR0hlRGJqZzVFX01oVTNocDFvXy1WQXZhMWF5djJxTkE2WnFEYUtqVy1tNnJyVWZoYWhHT3JaNkVxcmlObHVUeWt1VzlnV3VjVUpQd3l5bEN1NEJaMldYaWRFSGZlWXotcU5GUXpwTEl4emQ0MUhrQmh3SHlnWk5vN0FXSnhldzdPVlBuaTlDQ3FQVTFYV24wTEhrWlFsdk5EbUs0Vnc1bzFCRDBjZDVPWnV6TjRJLXktQS1ydWJPeFBjaFVXWHo5MXR6SU13ZDNDeWFoVW5JYmdKdHBaMEhQSXdPTVVzaUJnTjNTbnllalZmSFM1aEtXRzRCWDF1S01MNExrcjg1aDFZNlZQTUdNVUQ2STNsUkpGRE1rWmliQTZrS0d0XzBfV250QjhDWmV6T3E4ak51WVluU09vN2kyMV9GUU41QmJLNWtDSDNGbGgyVjlsTkVXbEJsNmRNaEFuWUhEWGNrdmlhT1lqRlRMSGZIOXE5Ti1DOS1mN0pCNG5pdVdHaXllVmVHNUVGV2ZtMFVwU1VSQmVtWVhScEtiQ3JWZTZndFV6bll3dDZONWdKTFZzU1RvVWhlUmR2WVFzclhFZWc0WV9WZGFHY0Z5S3FWdUZzdXVtMzh1UjI3Vk1XcjZiSkZQR3pTUjEyN1pwZVg4RllDakdLNGRVQXp4emZtMzdrdlRRV2VyN0I1bmcxQXNNX2M5NmRhVVNRVEJ3VWJpaUFrQmhQUFh2bEZRMnkzbWZYQVhTNTBpaGJySm9YWjJsbUowWDR3ZDZFRFJWc25PLWZ4YW55dExRN3NwdHk5VHlqOE82em9DMVdOSTVVc095V056VXpnNk80NFhLRHo0MmFPMERUUU45UHlnR3loUVBrNFRHUzZZTXYwOWxSUDVsS29jRVlGbFdlU1NhYU4wR2V3NHNIdmpiUzhPN1RUTW4wdFJQY2J3X0ZDRFJRTnB3ZTFTU0RlREEwUkdYS1pZWkoyUEZPOUJveWZFNldTV2JiZm1JYWJXNmdfQXA1RXdRMVpGM3RsejFjZmRPSWJkRzlTMmg1RndpajJPYzlOWGFSU3RuZG1ibFBPc3RXaUtZNlEyYkh1c0FIT083SHVKRVZoTE9CUDl6WGt5VTRIdmlCN0h3aDN6TjlicE5DLV8wbm9Bd0xLWmpRU0RLM1hGY3BFZkZzV1h5T2doR0V6YUoyOWpZNjAwNnVRRmVpWUNXRUtpTDhuelE5U0ozTXlOMkdhZVZIR3Etc2E2V25zRUxvYWhlQ1N4Mlc0cG9nNC04eWhrcm9Wdk5zSlJtMHRfd01CZHllZzB2VldvM3BVbERnNzczSXRzQnZKa0pabHBhME1FdjdOaWNxaG5FT0ZJUjhTY3FCcEw0R0huMFRnVEVEa004cmRxd1piN3Vsa2xjdFE5SVllUnViSmk2c1BBWWVrbnp4aEVMNmRiUFZGSHVzbVNQMTVhY00yQXZWUTNBRXplMTVqcSZjaWQ9Q0FRU0d3RElDYWFOU2FrRWlDUS1WLW91aF9zRUdzdnFNT1FrQW1RUmVSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgMAwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDTM3LjE5LjIxMi4xMDWoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFjJKG49LjhPtsqgUqODRjZWMwYWUtODQ2ZS00ZTMzLTlmOWYtNjc5MjE4YmY3NzJmfjMyNH4xwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAF2vgw-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHuO8F0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfnsQmKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=aae06186475aa245e4dda5f391faa638ccf42d89&bdref=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp,about%3Ablank&

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.69 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:10 GMT
an-x-request-uuid: 5be0b823-dab0-4c6d-aab6-435c6e0c12b3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.105; 37.19.212.105; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6338 0
20 B 60ms
59ms Image
image/gif 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-B_GqEr53JLBKXRkMum08I3onIKg4U4HK_b69ICAut4HMstwQJg-asugdpR7UUvo2FOtjotOFUOCRT5PVKmoeciTXhVD2LgnLEjxrSBy2JNDP9iltU

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKBOPBMARwAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmNzBlMmFhNS03Njc4LTQzNWItOGYyMC1iY2QwOTVjZTQ4MWHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTU0MzkzNjkyN_ICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO3ZhciBsPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bmN0aW9uKGEsYyl7cmV0dXJuIEFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoYSxjLHZvaWQgMCl9OmZ1bmN0aW9uKGEsYyl7aWYoInN0cmluZyI9PT10eXBlb2YgYSlyZXR1cm4ic3RyaW5nIiE9PXR5cGVvZiBjfHwxIT1jLmxlbmd0aD8tMTphLmluZGV4T2YoYywwKTtmb3IodmFyIGU9MDtlPGEubGVuZ3RoO2UrKylpZihlIGluIGEmJmFbZV09PT1jKXJldHVybiBlO3JldHVybi0xfTtmdW5jdGlvbiBtKGEpe21bIiAiXShhKTtyZXR1cm4gYX1tWyIgIl09ZnVuYy2VBH07EdV0IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7EUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJTIIZSl7IZoUYj0hMTtiGVKAYj8hMTpiO2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7AVEUZD1uKGEuEZcQKTtpZigNawRmPRHICCgpexkXBGc9WlMARCxoPWwoZyxkKTswPD1oJiZBcjYFAiRzcGxpY2UuY2FsASdsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAMGImJihkLmF0dHJpYnVBHhRTcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BMcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3RhYAB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXeDGE9Yy6J1nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWshKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRh0KCksYz1h8X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAkMDw9Yz9hLnN1YhZaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CX0dxRXI1M0pMQktYUmtNdW0wOEkzb25JS2c0VTRIS19iNjlJQ0F1dDRITXN0d1FKZy1hc3VnZHBSN1VVdm8yRk90am90T0ZVT0NSVDVQVkttb2VjaVRYaFZEMkxnbkxFanhyU0J5MkpORFA5aWx0VSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS98ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaLwwIiQE8KX82HQEWJQpQYWRzLmcuZG91YmxlY2xpY2submV0MRs8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dORwge3IzcHgoJya7DBwnKTt9KSgpO10AEOoWChBIAZ40UE9SVF9QQVJBTVMS1RaROYqVAPCkYWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTA1Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9YW55ZmlsZS1uPiMOECZzdWJfDZUAYkGx8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUZrWHRBQkJIYlFBakljMEFjT05OQUYwa1RRQjRaSTBBWkdUTkFFTGxEUUJVWlEwQWNpVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBVS1XTkFGd2xqUUJkSlkwQVhhV05BRjgBECxnNVkwQVk2V05BR1IBEBhvSlkwQWFpARAAcgEQCHJaWQGAEFdOQUhTARAAMwEgAGUFEABtARAYNnBZMEFldQEgADQBEEBBWmMwQVFxWE5BRXdselFCTwEQGFVDWE5BRkIBEBhRcGMwQVVlARAAUQEQFFU1YzBBVwUg9EkETGMwRUJVM05CQVZoelFRRmFQTm9CSDRRSEFuOGVYQUphLVlnQzVmMklBaWRDcWdJN1dxb0NJMjZxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xGdGFvQzhfV3FBbW40cWdJbS02b0NRZnVxQWxFTHF3SThJNnNDaENlckFsUW9xd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQW1JN3F3SzFQS3NDQWotckFteEtxd0pSVGFzQ3dFMnJBbUJPcXdLNFRxc0M5RkNyQWdKUnF3SUtVYXNDaTF1ckFpQmNxd0lXWXFzQzVHU3JBc05ucXdJUGFxc0NHWEdyQXRkeHF3THhjYXNDc0hLckFvQnpxd0xNZEtzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDVTRDckFyaUFxd0tiZ2FzQ040S3JBbktIcXdLNWg2c0NvSXFyQXNpTHF3SUFqS3NDc295ckFyYU1xd0s0aktzQ0FwQ3JBdWFScXdJWWxhc0NISmFyQWxDWHF3TEdsNnNDREppckFnNmFxd0xybmFzQ01aNnJBc1dlcXdMT25xc0NBNS1yQXZPZnF3TFZvYXNDNzZHckFqV2lxd0tWbzZzQ3FxT3JBdHFrcXdMcHBxc0NNYWlyQWdDcHF3S2lxYXNDMmFtckF2eXBxd0lkcXFzQzI2dXJBbHF0cXdJVnJxc0NKYTZyQWtLdXF3SkVycXNDYzY2ckF1Q3Vxd0k3cjZzQ2c2LXJBcC12cXdJSnNhc0NGckdyQW5XeHF3S3JzYXNDWXJLckFudXpxd0tzczZzQ0ZyU3JBaHEwcXdJaHRLc0NKYlNyQWltMHF3STZ0S3NDaHJTckFnbTFxd0lGdHFzQ0o3YXJBdXUycXdJV3Q2c0NKYmVyQWoyM3F3S0t0NnNDYXJpckFwRzRxd0xhdUtzQzc3aXJBaUs1cXdJcXVhc0MtYm1yQWlPN3F3SW11NnNDTWJ1ckF1cTdxd0xCYkNRRXNGMzNCSVcweFFXdHptVU9XYlg3RWxuSy14S1Q2dnNTTEE3OEVyUU9fQkpXRF93U3JSTDhFcTRUX0JKaUdQd1NlQmo4RXN3Wl9CSmtHX3dTd3h2OEV1a2JfQklNSGZ3U09SMzhFdWNkX0JMcEhmd1NaMTNRRTFaZHl5Ylc4RmtveXN1MUxnJmV4az0xNTQzOTM2OTI3JmF3YmlkX2M9QUtBbWYtREJUWU1RVEQzOWJfMHN0VXpxOXgxNzdmNEJJaHk4ZFJwNl9zbHBBcksxQVFYaDVJZXVFQWNjLUhSc1VnSDN3ZThCSXg1bERIV0NBT2ZxeGZ5ODgyYXhuaGJuMnJjcloyOGZwWW9SLS1sMm9aNjBYNURvWG92WHdxMFhFallOcHFxOVdkMVZhLWh1b2VSSkMxbEpLdGtILVZ0ajJkN1pZc3lPMzFvcTVjci1rcktCLWRr7b0AZO299CsFQWRUZGQ2RThQR0xOM1NZSldXU2F4b0UydnlaX1pMUlJEazNLMzlxa3FZcUpDVWdMaXRPdmkwbHRVNzhfeGpYWjFwVUZNc1ppMXFFa0RwV3F4RVFLdHNMMHFVNExzSmM5ajBNWV9weXZiTEFGQVJ4RHpzR0hlRGJqZzVFX01oVTNocDFvXy1WQXZhMWF5djJxTkE2WnFEYUtqVy1tNnJyVWZoYWhHT3JaNkVxcmlObHVUeWt1VzlnV3VjVUpQd3l5bEN1NEJaMldYaWRFSGZlWXotcU5GUXpwTEl4emQ0MUhrQmh3SHlnWk5vN0FXSnhldzdPVlBuaTlDQ3FQVTFYV24wTEhrWlFsdk5EbUs0Vnc1bzFCRDBjZDVPWnV6TjRJLXktQS1ydWJPeFBjaFVXWHo5MXR6SU13ZDNDeWFoVW5JYmdKdHBaMEhQSXdPTVVzaUJnTjNTbnllalZmSFM1aEtXRzRCWDF1S01MNExrcjg1aDFZNlZQTUdNVUQ2STNsUkpGRE1rWmliQTZrS0d0XzBfV250QjhDWmV6T3E4ak51WVluU09vN2kyMV9GUU41QmJLNWtDSDNGbGgyVjlsTkVXbEJsNmRNaEFuWUhEWGNrdmlhT1lqRlRMSGZIOXE5Ti1DOS1mN0pCNG5pdVdHaXllVmVHNUVGV2ZtMFVwU1VSQmVtWVhScEtiQ3JWZTZndFV6bll3dDZONWdKTFZzU1RvVWhlUmR2WVFzclhFZWc0WV9WZGFHY0Z5S3FWdUZzdXVtMzh1UjI3Vk1XcjZiSkZQR3pTUjEyN1pwZVg4RllDakdLNGRVQXp4emZtMzdrdlRRV2VyN0I1bmcxQXNNX2M5NmRhVVNRVEJ3VWJpaUFrQmhQUFh2bEZRMnkzbWZYQVhTNTBpaGJySm9YWjJsbUowWDR3ZDZFRFJWc25PLWZ4YW55dExRN3NwdHk5VHlqOE82em9DMVdOSTVVc095V056VXpnNk80NFhLRHo0MmFPMERUUU45UHlnR3loUVBrNFRHUzZZTXYwOWxSUDVsS29jRVlGbFdlU1NhYU4wR2V3NHNIdmpiUzhPN1RUTW4wdFJQY2J3X0ZDRFJRTnB3ZTFTU0RlREEwUkdYS1pZWkoyUEZPOUJveWZFNldTV2JiZm1JYWJXNmdfQXA1RXdRMVpGM3RsejFjZmRPSWJkRzlTMmg1RndpajJPYzlOWGFSU3RuZG1ibFBPc3RXaUtZNlEyYkh1c0FIT083SHVKRVZoTE9CUDl6WGt5VTRIdmlCN0h3aDN6TjlicE5DLV8wbm9Bd0xLWmpRU0RLM1hGY3BFZkZzV1h5T2doR0V6YUoyOWpZNjAwNnVRRmVpWUNXRUtpTDhuelE5U0ozTXlOMkdhZVZIR3Etc2E2V25zRUxvYWhlQ1N4Mlc0cG9nNC04eWhrcm9Wdk5zSlJtMHRfd01CZHllZzB2VldvM3BVbERnNzczSXRzQnZKa0pabHBhME1FdjdOaWNxaG5FT0ZJUjhTY3FCcEw0R0huMFRnVEVEa004cmRxd1piN3Vsa2xjdFE5SVllUnViSmk2c1BBWWVrbnp4aEVMNmRiUFZGSHVzbVNQMTVhY00yQXZWUTNBRXplMTVqcSZjaWQ9Q0FRU0d3RElDYWFOU2FrRWlDUS1WLW91aF9zRUdzdnFNT1FrQW1RUmVSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP7AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeSJ2D64dDfSOATJ0RUYxSUNoVXRYczhNMjlwTjVKQnZhMnJudDdrQW4wbGdXdC0xeUVVTXljQ3dLZ01JREtSY2UtZTNoY1JvRGVQZU9pbzVXd1hmTnNrdjhVMlZmWXZ1X3dUSEU0VTNhRmk0bjUyY0dwVFhxSzRiN0kmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSMzI3NzkzOTk4MDI0OTU2MjU4Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4xOS4yMTIuMTA1qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYyShuPS44T7bKoFKjg0Y2VjMGFlLTg0NmUtNGUzMy05ZjlmLTY3OTIxOGJmNzcyZn4zMjR-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEBIvGx0BsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHuO8F0gcNCRE4ATUI2gcGCfWo4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=775780ea6a9971de63f3a71de6ffa2d417e38a4c

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 6338 7 KB
3 KB 37ms
36ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6cf4189247ceccbc67687e6bbc383d0ca3d9739c8b8429296c03909b1933777a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:06:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1910
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3343
x-xss-protection: 0
server: cafe
etag: 3680861016058904691
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 17 Nov 2023 16:06:20 GMT

GET
H2 200 it
lax1-ib.adnxs.com/ Frame 6338 0
646 B 88ms
87ms Image
text/html 104.254.151.69
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lax1-ib.adnxs.com/it?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLpBvBMaQMAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG8MKYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJGY3MGUyYWE1LTc2NzgtNDM1Yi04ZjIwLWJjZDA5NWNlNDgxYdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA_sBCtQBaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCYFBvQOAV9iPUFLQW1mLUIydEVGMUlDaFV0WHM4TTI5cE41SkJ2YTJybnQ3a0FuMGxnV3QtMXlFVU15Y0N3S2dNSURLUmNlLWUzaGNSb0RlUGVPaW81V3dYZk5za3Y4VTJWZll2dV93VEhFNFUzYUZpNG41MmNHcFRYcUs0YjdJJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjMyNzc5Mzk5ODAyNDk1NjI1OCIINzcyMjE3OTMqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQNMzcuMTkuMjEyLjEwNagEALIEDAgAEAAYACAAMAA4ArgEAMAEAMgEANoEAggB4AQA8AQh-PBDiAUBmAUAoAWMkobj0uOE-2yqBSo4NGNlYzBhZS04NDZlLTRlMzMtOWY5Zi02NzkyMThiZjc3MmZ-MzI0fjHABQDJBQBFVRTwP9IFCQkFC3wAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgEhNAAA8D_QBu6PAdoGFgoQCRIZAbAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMjI5MjIyMzE3NDfIB7jvBdIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=f47c4e5dff7d8a552b43ec5d3487aa25d9c04f2d

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.69 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:10 GMT
an-x-request-uuid: 8aefefc8-01ca-483b-aba7-b90e99eebf3f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.105; 37.19.212.105; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/240/ Frame 6338 80 KB
28 KB 54ms
17ms Script
application/x-javascript 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/240/trk.js
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKBOPBMARwAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmNzBlMmFhNS03Njc4LTQzNWItOGYyMC1iY2QwOTVjZTQ4MWHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTU0MzkzNjkyN_ICyBUKC1BSRV9TQ1JJUFRTErgVPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz10aGlzfHxzZWxmO3ZhciBsPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bmN0aW9uKGEsYyl7cmV0dXJuIEFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoYSxjLHZvaWQgMCl9OmZ1bmN0aW9uKGEsYyl7aWYoInN0cmluZyI9PT10eXBlb2YgYSlyZXR1cm4ic3RyaW5nIiE9PXR5cGVvZiBjfHwxIT1jLmxlbmd0aD8tMTphLmluZGV4T2YoYywwKTtmb3IodmFyIGU9MDtlPGEubGVuZ3RoO2UrKylpZihlIGluIGEmJmFbZV09PT1jKXJldHVybiBlO3JldHVybi0xfTtmdW5jdGlvbiBtKGEpe21bIiAiXShhKTtyZXR1cm4gYX1tWyIgIl09ZnVuYy2VBH07EdV0IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7EUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJTIIZSl7IZoUYj0hMTtiGVKAYj8hMTpiO2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7AVEUZD1uKGEuEZcQKTtpZigNawRmPRHICCgpexkXBGc9WlMARCxoPWwoZyxkKTswPD1oJiZBcjYFAiRzcGxpY2UuY2FsASdsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGYsITEpO1IjAGI6ABBlcnJvcg07GH07ZC5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAMGImJihkLmF0dHJpYnVBHhRTcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BMcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3RhYAB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXeDGE9Yy6J1nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWshKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGsZqyHVZf8AZyUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGUV5gQmJgHMATsEOzBBZSVaCCYmZQVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9sVMEIHah1hwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCt0vAHd1SRh0KCksYz1h8X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAkMDw9Yz9hLnN1YhZaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLeAgoKRVhUUkFfVEFHUxLPAjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8J9fYj1BS0FtZi1CX0dxRXI1M0pMQktYUmtNdW0wOEkzb25JS2c0VTRIS19iNjlJQ0F1dDRITXN0d1FKZy1hc3VnZHBSN1VVdm8yRk90am90T0ZVT0NSVDVQVkttb2VjaVRYaFZEMkxnbkxFanhyU0J5MkpORFA5aWx0VSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIgc3R5IS98ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaLwwIiQE8KX82HQEWJQpQYWRzLmcuZG91YmxlY2xpY2submV0MRs8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dORwge3IzcHgoJya7DBwnKTt9KSgpO10AEOoWChBIAZ40UE9SVF9QQVJBTVMS1RaROYqVAPCkYWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTA1Jm91dHB1dD1odG1sJnBzZD1XMTAlM0QmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9YW55ZmlsZS1uPiMOECZzdWJfDZUAYkGx8H1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUZrWHRBQkJIYlFBakljMEFjT05OQUYwa1RRQjRaSTBBWkdUTkFFTGxEUUJVWlEwQWNpVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBVS1XTkFGd2xqUUJkSlkwQVhhV05BRjgBECxnNVkwQVk2V05BR1IBEBhvSlkwQWFpARAAcgEQCHJaWQGAEFdOQUhTARAAMwEgAGUFEABtARAYNnBZMEFldQEgADQBEEBBWmMwQVFxWE5BRXdselFCTwEQGFVDWE5BRkIBEBhRcGMwQVVlARAAUQEQFFU1YzBBVwUg9EkETGMwRUJVM05CQVZoelFRRmFQTm9CSDRRSEFuOGVYQUphLVlnQzVmMklBaWRDcWdJN1dxb0NJMjZxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xGdGFvQzhfV3FBbW40cWdJbS02b0NRZnVxQWxFTHF3SThJNnNDaENlckFsUW9xd0w3SzZzQzFEYXJBaVU2cXdJcE9xc0NMVHFyQW1JN3F3SzFQS3NDQWotckFteEtxd0pSVGFzQ3dFMnJBbUJPcXdLNFRxc0M5RkNyQWdKUnF3SUtVYXNDaTF1ckFpQmNxd0lXWXFzQzVHU3JBc05ucXdJUGFxc0NHWEdyQXRkeHF3THhjYXNDc0hLckFvQnpxd0xNZEtzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDVTRDckFyaUFxd0tiZ2FzQ040S3JBbktIcXdLNWg2c0NvSXFyQXNpTHF3SUFqS3NDc295ckFyYU1xd0s0aktzQ0FwQ3JBdWFScXdJWWxhc0NISmFyQWxDWHF3TEdsNnNDREppckFnNmFxd0xybmFzQ01aNnJBc1dlcXdMT25xc0NBNS1yQXZPZnF3TFZvYXNDNzZHckFqV2lxd0tWbzZzQ3FxT3JBdHFrcXdMcHBxc0NNYWlyQWdDcHF3S2lxYXNDMmFtckF2eXBxd0lkcXFzQzI2dXJBbHF0cXdJVnJxc0NKYTZyQWtLdXF3SkVycXNDYzY2ckF1Q3Vxd0k3cjZzQ2c2LXJBcC12cXdJSnNhc0NGckdyQW5XeHF3S3JzYXNDWXJLckFudXpxd0tzczZzQ0ZyU3JBaHEwcXdJaHRLc0NKYlNyQWltMHF3STZ0S3NDaHJTckFnbTFxd0lGdHFzQ0o3YXJBdXUycXdJV3Q2c0NKYmVyQWoyM3F3S0t0NnNDYXJpckFwRzRxd0xhdUtzQzc3aXJBaUs1cXdJcXVhc0MtYm1yQWlPN3F3SW11NnNDTWJ1ckF1cTdxd0xCYkNRRXNGMzNCSVcweFFXdHptVU9XYlg3RWxuSy14S1Q2dnNTTEE3OEVyUU9fQkpXRF93U3JSTDhFcTRUX0JKaUdQd1NlQmo4RXN3Wl9CSmtHX3dTd3h2OEV1a2JfQklNSGZ3U09SMzhFdWNkX0JMcEhmd1NaMTNRRTFaZHl5Ylc4RmtveXN1MUxnJmV4az0xNTQzOTM2OTI3JmF3YmlkX2M9QUtBbWYtREJUWU1RVEQzOWJfMHN0VXpxOXgxNzdmNEJJaHk4ZFJwNl9zbHBBcksxQVFYaDVJZXVFQWNjLUhSc1VnSDN3ZThCSXg1bERIV0NBT2ZxeGZ5ODgyYXhuaGJuMnJjcloyOGZwWW9SLS1sMm9aNjBYNURvWG92WHdxMFhFallOcHFxOVdkMVZhLWh1b2VSSkMxbEpLdGtILVZ0ajJkN1pZc3lPMzFvcTVjci1rcktCLWRr7b0AZO299CsFQWRUZGQ2RThQR0xOM1NZSldXU2F4b0UydnlaX1pMUlJEazNLMzlxa3FZcUpDVWdMaXRPdmkwbHRVNzhfeGpYWjFwVUZNc1ppMXFFa0RwV3F4RVFLdHNMMHFVNExzSmM5ajBNWV9weXZiTEFGQVJ4RHpzR0hlRGJqZzVFX01oVTNocDFvXy1WQXZhMWF5djJxTkE2WnFEYUtqVy1tNnJyVWZoYWhHT3JaNkVxcmlObHVUeWt1VzlnV3VjVUpQd3l5bEN1NEJaMldYaWRFSGZlWXotcU5GUXpwTEl4emQ0MUhrQmh3SHlnWk5vN0FXSnhldzdPVlBuaTlDQ3FQVTFYV24wTEhrWlFsdk5EbUs0Vnc1bzFCRDBjZDVPWnV6TjRJLXktQS1ydWJPeFBjaFVXWHo5MXR6SU13ZDNDeWFoVW5JYmdKdHBaMEhQSXdPTVVzaUJnTjNTbnllalZmSFM1aEtXRzRCWDF1S01MNExrcjg1aDFZNlZQTUdNVUQ2STNsUkpGRE1rWmliQTZrS0d0XzBfV250QjhDWmV6T3E4ak51WVluU09vN2kyMV9GUU41QmJLNWtDSDNGbGgyVjlsTkVXbEJsNmRNaEFuWUhEWGNrdmlhT1lqRlRMSGZIOXE5Ti1DOS1mN0pCNG5pdVdHaXllVmVHNUVGV2ZtMFVwU1VSQmVtWVhScEtiQ3JWZTZndFV6bll3dDZONWdKTFZzU1RvVWhlUmR2WVFzclhFZWc0WV9WZGFHY0Z5S3FWdUZzdXVtMzh1UjI3Vk1XcjZiSkZQR3pTUjEyN1pwZVg4RllDakdLNGRVQXp4emZtMzdrdlRRV2VyN0I1bmcxQXNNX2M5NmRhVVNRVEJ3VWJpaUFrQmhQUFh2bEZRMnkzbWZYQVhTNTBpaGJySm9YWjJsbUowWDR3ZDZFRFJWc25PLWZ4YW55dExRN3NwdHk5VHlqOE82em9DMVdOSTVVc095V056VXpnNk80NFhLRHo0MmFPMERUUU45UHlnR3loUVBrNFRHUzZZTXYwOWxSUDVsS29jRVlGbFdlU1NhYU4wR2V3NHNIdmpiUzhPN1RUTW4wdFJQY2J3X0ZDRFJRTnB3ZTFTU0RlREEwUkdYS1pZWkoyUEZPOUJveWZFNldTV2JiZm1JYWJXNmdfQXA1RXdRMVpGM3RsejFjZmRPSWJkRzlTMmg1RndpajJPYzlOWGFSU3RuZG1ibFBPc3RXaUtZNlEyYkh1c0FIT083SHVKRVZoTE9CUDl6WGt5VTRIdmlCN0h3aDN6TjlicE5DLV8wbm9Bd0xLWmpRU0RLM1hGY3BFZkZzV1h5T2doR0V6YUoyOWpZNjAwNnVRRmVpWUNXRUtpTDhuelE5U0ozTXlOMkdhZVZIR3Etc2E2V25zRUxvYWhlQ1N4Mlc0cG9nNC04eWhrcm9Wdk5zSlJtMHRfd01CZHllZzB2VldvM3BVbERnNzczSXRzQnZKa0pabHBhME1FdjdOaWNxaG5FT0ZJUjhTY3FCcEw0R0huMFRnVEVEa004cmRxd1piN3Vsa2xjdFE5SVllUnViSmk2c1BBWWVrbnp4aEVMNmRiUFZGSHVzbVNQMTVhY00yQXZWUTNBRXplMTVqcSZjaWQ9Q0FRU0d3RElDYWFOU2FrRWlDUS1WLW91aF9zRUdzdnFNT1FrQW1RUmVSZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgP7AQrUAWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeSJ2D64dDfSOATJ0RUYxSUNoVXRYczhNMjlwTjVKQnZhMnJudDdrQW4wbGdXdC0xeUVVTXljQ3dLZ01JREtSY2UtZTNoY1JvRGVQZU9pbzVXd1hmTnNrdjhVMlZmWXZ1X3dUSEU0VTNhRmk0bjUyY0dwVFhxSzRiN0kmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSMzI3NzkzOTk4MDI0OTU2MjU4Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4xOS4yMTIuMTA1qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYyShuPS44T7bKoFKjg0Y2VjMGFlLTg0NmUtNGUzMy05ZjlmLTY3OTIxOGJmNzcyZn4zMjR-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEBIvGx0BsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHuO8F0gcNCRE4ATUI2gcGCfWo4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=775780ea6a9971de63f3a71de6ffa2d417e38a4c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 519e50788224b3422c6e6b1cce48d5decb83eece248558b54e48f88491e48aa4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Expires: Thu, 14 Nov 2024 14:07:00 GMT
Date: Fri, 17 Nov 2023 15:38:10 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 178271
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27680
X-Served-By: cache-lga21956-LGA, cache-yyz4549-YYZ
Last-Modified: Wed, 15 Nov 2023 14:06:46 GMT
Server: AkamaiNetStorage
X-Timer: S1700235491.934084,VS0,VE0
ETag: "ccac3ab7f323b8743d099010fcce15a4:1700057206.383562"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 34, 118840

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 7FE6 13 KB
5 KB 36ms
35ms Document
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lax1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 45377
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 4767
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 03:01:53 GMT
etag: 12223946614886178233
expires: Sat, 18 Nov 2023 03:01:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 7FE6 142 KB
44 KB 203ms
202ms XHR
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5eba385dda33cb515c56a744b6679c6619bf6b6030c832562da2f0963c157644

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 17 Nov 2023 15:38:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45162
x-xss-protection: 0

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame 6338 0
663 B 87ms
86ms Ping
text/html 104.254.151.69
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLpBvBMaQMAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG8MKYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJGY3MGUyYWE1LTc2NzgtNDM1Yi04ZjIwLWJjZDA5NWNlNDgxYdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA_sBCtQBaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCYFBvQOAV9iPUFLQW1mLUIydEVGMUlDaFV0WHM4TTI5cE41SkJ2YTJybnQ3a0FuMGxnV3QtMXlFVU15Y0N3S2dNSURLUmNlLWUzaGNSb0RlUGVPaW81V3dYZk5za3Y4VTJWZll2dV93VEhFNFUzYUZpNG41MmNHcFRYcUs0YjdJJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjMyNzc5Mzk5ODAyNDk1NjI1OCIINzcyMjE3OTMqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQNMzcuMTkuMjEyLjEwNagEALIEDAgAEAAYACAAMAA4ArgEAMAEAMgEANoEAggB4AQA8AQh-PBDiAUBmAUAoAWMkobj0uOE-2yqBSo4NGNlYzBhZS04NDZlLTRlMzMtOWY5Zi02NzkyMThiZjc3MmZ-MzI0fjHABQDJBQBFVRTwP9IFCQkFC3wAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgEhNAAA8D_QBu6PAdoGFgoQCRIZAbAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMjI5MjIyMzE3NDfIB7jvBdIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=f47c4e5dff7d8a552b43ec5d3487aa25d9c04f2d&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=5221378421101283707&vd=ct~0|rr~0&sv=240&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.69 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:11 GMT
an-x-request-uuid: 40b23de0-964a-4f40-ad9d-f496b89cc0de
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.105; 37.19.212.105; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 44bd00f78f744677d235ac64cd0d9746.js Show response
www.gstatic.com/mysidia/ Frame 7FE6 16 KB
7 KB 359ms
36ms Script
text/javascript 172.253.63.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/44bd00f78f744677d235ac64cd0d9746.js?tag=client_fast_engine

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f94.1e100.net

Software

sffe /

Resource Hash

5912573d23fb67fc31e4ee18ec720ff835cc870171524089812b7dd0d302d382

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 00:03:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56057
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6607
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 15 Feb 2024 00:03:54 GMT

GET
H2 200 edf5c5d87b1722f5a42c31db19c9ecf9.js Show response
www.gstatic.com/mysidia/ Frame 7FE6 15 KB
6 KB 362ms
39ms Script
text/javascript 172.253.63.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/edf5c5d87b1722f5a42c31db19c9ecf9.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f94.1e100.net

Software

sffe /

Resource Hash

c606a44b50a9a5e0c391e5344d45eb7206ed7a24c9983cad588ba2d7f68df677

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:51:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56774
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6349
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 14 Feb 2024 23:51:57 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 7FE6 14 KB
1 KB 49ms
46ms Stylesheet
text/css 142.251.111.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f95.1e100.net

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 17 Nov 2023 15:38:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 14:29:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 Nov 2023 15:38:11 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 7FE6 3 KB
1 KB 38ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdbe9b84c30a00229826b0b1e354c94d36dd6bf16e6580bbef43877689c8f5bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 02:55:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45736
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1182
x-xss-protection: 0
server: cafe
etag: 16216481440669322801
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 02:55:55 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 7FE6 31 KB
12 KB 38ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 03:21:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44213
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 03:21:18 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 7FE6 3 KB
1 KB 51ms
49ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 07:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29087
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1307
x-xss-protection: 0
server: cafe
etag: 18393213423120915576
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 07:33:24 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 7FE6 30 KB
12 KB 40ms
38ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08c05eef46cc157c6a54a58314c54f49f00911af49a3971c5ad96a65a9896acd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:33:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21881
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11767
x-xss-protection: 0
server: cafe
etag: 15139768082260502484
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:33:30 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7FE6 0
0 374ms
49ms Image
text/html 142.250.31.104
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRgPqKOzm6RLALB2DiL7niKnFK9UIqtPTb7LnVcMiy8L4BnJULYTM4vMOrWkpz6i-arhKvY_Z5ELF8wBfmFfbR_rpXgCg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.31.104 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bj-in-f104.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7FE6 203 KB
64 KB 59ms
58ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

sffe /

Resource Hash

f68b49b743e29d28f46d9321318cd1fbdc017ddd6a4bdcdac1730ffc20b9f60e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65395
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700052045412510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Nov 2023 15:38:11 GMT

GET
H2 200 be31b2ab706a93d748cb1e74ae2e5fe5.js Show response
www.gstatic.com/mysidia/ Frame 7FE6 54 KB
20 KB 361ms
41ms Script
text/javascript 172.253.63.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/be31b2ab706a93d748cb1e74ae2e5fe5.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f94.1e100.net

Software

sffe /

Resource Hash

2faf349343cf89d32efa31d1f703aec42c00ef6fd1fc7ff3f6aefc9849957488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 05:07:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37846
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20533
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 15 Feb 2024 05:07:25 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4BEF 143 B
166 B 37ms
37ms Document
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2177
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:01:54 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7FE6 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef4beeede949fff080bfffb14b52345458496f329900a5167829f940d1fe362a

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 7FE6 33 KB
34 KB 111ms
36ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 21:54:04 GMT
x-content-type-options: nosniff
age: 63847
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Nov 2024 21:54:04 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 7FE6
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=ClRpG3ohXZazlPOLF998PkaObgAXg_5yJdIvw4uCnEI-esO3WMBABIOaX1iVg_aCZgegDoAGr1bS7AsgBAagDAcgDywSqBOIBT9B1hxbwZOKamUOF4vySXLcdq-o0wtEoaq1WZwASeXV34_y...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xb8e6f89fcd1e11750000000000000000%22,%222%22:%220xc416ded67d519ec10000000000000000%22,%223%22:%220xabefc2...

0
0

132ms
60ms

Fetch
text/css

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xb8e6f89fcd1e11750000000000000000%22,%222%22:%220xc416ded67d519ec10000000000000000%22,%223%22:%220xabefc217b85e29970000000000000000%22,%224%22:%220x8ef4b2e284a913540000000000000000%22,%225%22:%220x4766bbc65aa808140000000000000000%22},%22debug_key%22:%2214492242684577608901%22,%22debug_reporting%22:true,%22destination%22:%22https://globalization-partners.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22661465771%22],%224%22:[%2211-17%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210095170379691248865%22}&andc=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xb8e6f89fcd1e11750000000000000000","2":"0xc416ded67d519ec10000000000000000","3":"0xabefc217b85e29970000000000000000","4":"0x8ef4b2e284a913540000000000000000","5":"0x4766bbc65aa808140000000000000000"},"debug_key":"14492242684577608901","debug_reporting":true,"destination":"https://globalization-partners.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["661465771"],"4":["11-17"],"6":["true"]},"priority":"500","source_event_id":"10095170379691248865"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 17 Nov 2023 15:38:12 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 17 Nov 2023 15:38:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xb8e6f89fcd1e11750000000000000000","2":"0xc416ded67d519ec10000000000000000","3":"0xabefc217b85e29970000000000000000","4":"0x8ef4b2e284a913540000000000000000","5":"0x4766bbc65aa808140000000000000000"},"debug_key":"14492242684577608901","debug_reporting":true,"destination":"https://globalization-partners.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["661465771"],"4":["11-17"],"6":["true"]},"priority":"500","source_event_id":"10095170379691248865"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4BEF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

48ms
47ms

Document
text/html

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:38:11 GMT
expires: Fri, 17 Nov 2023 15:38:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:38:11 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 1155ms
59ms Preflight
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 17 Nov 2023 15:38:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js Show response
pagead2.googlesyndication.com/bg/ Frame C5CF 39 KB
15 KB 37ms
36ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea1ece673616b82840316d3236fc1a02a37f6eb1fcf653812c7117a3c11b315a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:50:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56849
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15097
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Nov 2024 23:50:42 GMT

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame 6338 0
663 B 86ms
86ms Ping
text/html 104.254.151.69
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLpBvBMaQMAAAMA1gAFAQjekd6qBhDisqHe-NyjxgQY9rb78a6en95gKjYJgV64c2FgSEAR7umP1VK4REAZAAAAIFwPQEAh7umP1VK4REApgV4JJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHi47wWAAQGKAQNVU0SSAQEG8MKYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJGY3MGUyYWE1LTc2NzgtNDM1Yi04ZjIwLWJjZDA5NWNlNDgxYdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA_sBCtQBaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCYFBvQOAV9iPUFLQW1mLUIydEVGMUlDaFV0WHM4TTI5cE41SkJ2YTJybnQ3a0FuMGxnV3QtMXlFVU15Y0N3S2dNSURLUmNlLWUzaGNSb0RlUGVPaW81V3dYZk5za3Y4VTJWZll2dV93VEhFNFUzYUZpNG41MmNHcFRYcUs0YjdJJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjMyNzc5Mzk5ODAyNDk1NjI1OCIINzcyMjE3OTMqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQNMzcuMTkuMjEyLjEwNagEALIEDAgAEAAYACAAMAA4ArgEAMAEAMgEANoEAggB4AQA8AQh-PBDiAUBmAUAoAWMkobj0uOE-2yqBSo4NGNlYzBhZS04NDZlLTRlMzMtOWY5Zi02NzkyMThiZjc3MmZ-MzI0fjHABQDJBQBFVRTwP9IFCQkFC3wAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgEhNAAA8D_QBu6PAdoGFgoQCRIZAbAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMjI5MjIyMzE3NDfIB7jvBdIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=f47c4e5dff7d8a552b43ec5d3487aa25d9c04f2d&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=5221378421101283707&vd=ct~0|rr~5&sv=240&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.69 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:12 GMT
an-x-request-uuid: ddca70bc-085c-444e-82fc-5bed3c0ca9f0
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.105; 37.19.212.105; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 19FD 0
596 B 35ms
35ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:12 GMT
an-x-request-uuid: c1e46ff6-4a6b-4776-bf68-806344e07435
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame AD24 0
128 B 84ms
83ms Script
text/plain 104.36.113.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156423&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:12 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7FE6 42 B
64 B 139ms
67ms Fetch
image/gif 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvAnMHYocQEzDRlnd6bwXxd9gX6RZsNBlfcC9SxdkaTVGnUGzxkh0o6caXZ-MudRvBxfiTd6c80lGfrUVHkpOWyPHS2vAGB_MVu0zHPFbfMwtwJlSp7xJdv3Nemog7aUqKG9ns9knb3_Q&sai=AMfl-YR-otNLSyxv0WZvI-t-0I1_xTHKZzMVmQeYh5ZtK20gDdQC-NdwAEKwtd8HJZLDGXDyWlFqK-Ro0Bmxk3XoLt6s7B1-irCnHNg&sig=Cg0ArKJSzI9O2GrX5hbMEAE&cid=CAQSKQDICaaN0zW4HhVqNBkx_U7roJeGBzcDVA4aoWIw-35UnMr_7zKTnv1fGAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231115&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1946892878&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700235490889&rpt=857&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 19FD 0
595 B 51ms
50ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:13 GMT
an-x-request-uuid: 0ba80d61-c339-4416-81bd-371a24b9c3f0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 37.19.212.105; 37.19.212.105; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6267815623625658211/ Frame 249A 131 KB
35 KB 116ms
39ms Document
text/html 172.253.122.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

603e9e7eea419894992b776f9c5cabd7c5b3c76ec45cb027cf274091b5bc772c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:38:14 GMT
expires: Sat, 16 Nov 2024 15:38:14 GMT
last-modified: Thu, 02 Nov 2023 07:41:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 716F 0
0 156ms
78ms Fetch
image/gif 172.253.62.148

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstBWIJsZIDL-TlOlCjFF_xnfaJIydn7O-fiRJx7O-iQVQFmoyPgc9tEg5A7MEjIgxTZzCYfYq-Crq2zyx6aFQKxOVCusABCwaj9IN8K6ZXl_gdXGd4INwR1BvN-Lcd2l2-t2UZ_JJXGin1HhuLT5APo8jVFuQXoUD_gIdNd82DEM9v_niQUWSgwza0djMkMP3QrNOsQG67tPj9QFSqTMlwARrx2v38jwIgajiBc-Lv1a86jkmTGQcZVBl6zpMNNXk3mmlrNodxufpIZbRab9C14mYaEvqurHw3zJx180fI1aL5pLISmXwAh9fxseXqFQlU_bEjrNeLqBht7Jyux1WjG37s4rsU0OR4gIeZxAWw04QlPFOhvwBIlhC61sDAyDrni_TAYJ4KMNQzO8CEleResMIqi6EIJEpnM-EsJgPpCF7a0OM0on0zzB692O1qR4aSo21nwvU4rmnpiKrB87qOS-J7LvKVQyKysSGQMvGvTnAWJi_vbDf9802nEHpVmVcg0eCJnWD9Vs9HK6S7fkblXbeG3EKWX-b4KFq8yMHqWK4EEHj9r_hyf7tyOtElURo0-6SaYWJIrSoXHayYlpMvS-jrsINNMohiQpK0w5D06yEsqvXRencZERdV7xvC8NLaJlnqTWj9rWdVJzYJ45aBy2bRrtcYxmqZDCnV56C8SnpV_x6Nf9y3dNWbnocBsJn7iqBey-ycPXMScqN4_UZf7vFxOmaaC-m9ivtvtD-FcSy7FD6oi56fWdhGb_LyT7VQcwYI5jZ8j6LlgJx2xGhMUt1WZ_K5GCRxYKnD44Nh_RKq8zpGyi5l3hdMsst0MoIMcSx6-eGGvbOSs1oP6T3Ymyz6W7qdG83Q1IG8SJ9s6dToSILjHyF7nIqiQbuY_NCeiSw4Sgb-5xIchsrajEvaNnPb38eqg44pRO0t1uVE2kWjpTiEzE86N9eHqJnCNHWHpspYp7FyHsuavvGyA5mS1tuHZypltcb42UENw7__VddKlvEE3wXwENDDGUrxyIcIzODZKrbxpiDvbJQaKiS0GtwGtm-OG4zEive1g7_Ho43jmyiqxLIP3eYVjZkhRI30jDKBycYrX-y_Xz5Eh8l33GeWBWPlMsXMXvNd9Vxpr-53i7FffHhSUdVf0WTGMPzCrmgAuQ0lxLQw_goBXsiO_OzhzZWRB9qTcFld8ZdviDL9cj8eSnq07YUJwXIqiFHaCNcCPo_Tl_4Jvf8Z2sfeyDzR82IokbfkYwOIOdhQ9mwSTVKoeekGE1jAuq_u_I9Q1Nlh_b0x2Tn8UwTTM4bcrtUdMxYA_wk9C7eRGaZ_hYbYI0M7fyC3XyUJUhcQixkBAwqbROnnntdnQZFkT94UKYqZIO2ftoenmQIG3tJxpmkJUohQ-U1_ZjB9DPMMHeaAzcWOGq6u4bbXvtF2EZ16QAgPA12DA1FYjLusf4Es&sai=AMfl-YTNk4QXKniPih2au2M6WqDsG3CKgAKayzBekMo5Ih28DS65IERfwJr1F8keeE3oQly3LoFgxO7xNEhn6x-Kl8KV_LJzE2tGfS17FRig909EnB0yNJEMK86EaLOVLBPL-mg-mfvFPP0YMdqpo1T6v4zuTMFRsFcGXov4duZxPGJ-VWdS8j3XlEQ6VWJZYtsJVMPm3rtXnaQp2SAGPhPGOKBFXfBG7L58U_bywbu6LRDI5co2_hYs80g8RHOxB5JgbxUYf3jV8mlvqqW1MJRsTyfPMak6wNhRiYkfGFR7ZQu-DhMJ4FyT4g5INoCRd7Vo_xoxRBqukf-DmUfbB_PTO0Esos9lHDXwCz4BwxxjXenEe51ibyPMkhyX8l73W1b4FLW_bZ2uP-ISCx7o_jhUGQvbY5WpjJy19_aGR4lnT7Fix8Y_Ny5iS5t7CjN2glh4uq-gIC2mZb35iBGxL0Rr-fg9KlpI-AyemsRKFdrRl7QynQzf5QkkkVccveF3C2dPgacE9w&sig=Cg0ArKJSzAGLaeXS-vdFEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9yb2dlcnMuY29t&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=7663&cbvp=1&cstd=7647&cisv=r20231109.15837&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.148 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 17 Nov 2023 15:38:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 249A 120 KB
41 KB 37ms
36ms Script
text/javascript 172.253.122.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 02:57:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45652
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 02:57:22 GMT

GET
H3 200 TedNext-Regular.woff
s0.2mdn.net/creatives/assets/3917894/ Frame 249A 31 KB
31 KB 35ms
35ms Font
font/woff 172.253.122.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3917894/TedNext-Regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1290957a16ed68fe7c035837191558c627b87ccc07eb8916b860a71477d4f065

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:23:29 GMT
x-content-type-options: nosniff
age: 885
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32068
x-xss-protection: 0
last-modified: Thu, 29 Oct 2020 14:12:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Nov 2023 15:38:29 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 249A 8 KB
6 KB 54ms
54ms XHR
application/json 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5bdbfb95b5f8084fbfbdae2783a1eb6e3f8eb2663035fd74d063baa1d324c1da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5811
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 716F 0
0 63ms
62ms Fetch
image/gif 172.253.62.148

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstBWIJsZIDL-TlOlCjFF_xnfaJIydn7O-fiRJx7O-iQVQFmoyPgc9tEg5A7MEjIgxTZzCYfYq-Crq2zyx6aFQKxOVCusABCwaj9IN8K6ZXl_gdXGd4INwR1BvN-Lcd2l2-t2UZ_JJXGin1HhuLT5APo8jVFuQXoUD_gIdNd82DEM9v_niQUWSgwza0djMkMP3QrNOsQG67tPj9QFSqTMlwARrx2v38jwIgajiBc-Lv1a86jkmTGQcZVBl6zpMNNXk3mmlrNodxufpIZbRab9C14mYaEvqurHw3zJx180fI1aL5pLISmXwAh9fxseXqFQlU_bEjrNeLqBht7Jyux1WjG37s4rsU0OR4gIeZxAWw04QlPFOhvwBIlhC61sDAyDrni_TAYJ4KMNQzO8CEleResMIqi6EIJEpnM-EsJgPpCF7a0OM0on0zzB692O1qR4aSo21nwvU4rmnpiKrB87qOS-J7LvKVQyKysSGQMvGvTnAWJi_vbDf9802nEHpVmVcg0eCJnWD9Vs9HK6S7fkblXbeG3EKWX-b4KFq8yMHqWK4EEHj9r_hyf7tyOtElURo0-6SaYWJIrSoXHayYlpMvS-jrsINNMohiQpK0w5D06yEsqvXRencZERdV7xvC8NLaJlnqTWj9rWdVJzYJ45aBy2bRrtcYxmqZDCnV56C8SnpV_x6Nf9y3dNWbnocBsJn7iqBey-ycPXMScqN4_UZf7vFxOmaaC-m9ivtvtD-FcSy7FD6oi56fWdhGb_LyT7VQcwYI5jZ8j6LlgJx2xGhMUt1WZ_K5GCRxYKnD44Nh_RKq8zpGyi5l3hdMsst0MoIMcSx6-eGGvbOSs1oP6T3Ymyz6W7qdG83Q1IG8SJ9s6dToSILjHyF7nIqiQbuY_NCeiSw4Sgb-5xIchsrajEvaNnPb38eqg44pRO0t1uVE2kWjpTiEzE86N9eHqJnCNHWHpspYp7FyHsuavvGyA5mS1tuHZypltcb42UENw7__VddKlvEE3wXwENDDGUrxyIcIzODZKrbxpiDvbJQaKiS0GtwGtm-OG4zEive1g7_Ho43jmyiqxLIP3eYVjZkhRI30jDKBycYrX-y_Xz5Eh8l33GeWBWPlMsXMXvNd9Vxpr-53i7FffHhSUdVf0WTGMPzCrmgAuQ0lxLQw_goBXsiO_OzhzZWRB9qTcFld8ZdviDL9cj8eSnq07YUJwXIqiFHaCNcCPo_Tl_4Jvf8Z2sfeyDzR82IokbfkYwOIOdhQ9mwSTVKoeekGE1jAuq_u_I9Q1Nlh_b0x2Tn8UwTTM4bcrtUdMxYA_wk9C7eRGaZ_hYbYI0M7fyC3XyUJUhcQixkBAwqbROnnntdnQZFkT94UKYqZIO2ftoenmQIG3tJxpmkJUohQ-U1_ZjB9DPMMHeaAzcWOGq6u4bbXvtF2EZ16QAgPA12DA1FYjLusf4Es&sai=AMfl-YTNk4QXKniPih2au2M6WqDsG3CKgAKayzBekMo5Ih28DS65IERfwJr1F8keeE3oQly3LoFgxO7xNEhn6x-Kl8KV_LJzE2tGfS17FRig909EnB0yNJEMK86EaLOVLBPL-mg-mfvFPP0YMdqpo1T6v4zuTMFRsFcGXov4duZxPGJ-VWdS8j3XlEQ6VWJZYtsJVMPm3rtXnaQp2SAGPhPGOKBFXfBG7L58U_bywbu6LRDI5co2_hYs80g8RHOxB5JgbxUYf3jV8mlvqqW1MJRsTyfPMak6wNhRiYkfGFR7ZQu-DhMJ4FyT4g5INoCRd7Vo_xoxRBqukf-DmUfbB_PTO0Esos9lHDXwCz4BwxxjXenEe51ibyPMkhyX8l73W1b4FLW_bZ2uP-ISCx7o_jhUGQvbY5WpjJy19_aGR4lnT7Fix8Y_Ny5iS5t7CjN2glh4uq-gIC2mZb35iBGxL0Rr-fg9KlpI-AyemsRKFdrRl7QynQzf5QkkkVccveF3C2dPgacE9w&sig=Cg0ArKJSzAGLaeXS-vdFEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9yb2dlcnMuY29t&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=7928&vt=11&dtpt=265&dett=3&cstd=7647&cisv=r20231109.15837&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.148 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 60018000_20201217082606274_Blank_160x600.png
s0.2mdn.net/ads/richmedia/studio/60018000/ Frame 249A 388 B
414 B 36ms
36ms Image
image/png 172.253.122.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60018000/60018000_20201217082606274_Blank_160x600.png

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb177e3ad58e5b03d799f2402e2fa7387750b83038a9a3f855e6075d1bc9a815

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 12:10:58 GMT
x-content-type-options: nosniff
age: 12436
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 388
x-xss-protection: 0
last-modified: Thu, 17 Dec 2020 16:26:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 12:10:58 GMT

GET
H3 200 60018000_20231107135145155_f2_160x600.png
s0.2mdn.net/ads/richmedia/studio/60018000/ Frame 249A 34 KB
34 KB 75ms
75ms Image
image/png 172.253.122.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60018000/60018000_20231107135145155_f2_160x600.png

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

039c5cb59398f92378f03179c2f6803ea33a19fcfb7773b272adbb3dc725e29f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:14 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34703
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 21:51:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 15:38:14 GMT

GET
H3 200 60018000_20231107123518809_f1_160x600.png
s0.2mdn.net/ads/richmedia/studio/60018000/ Frame 249A 64 KB
64 KB 37ms
36ms Image
image/png 172.253.122.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60018000/60018000_20231107123518809_f1_160x600.png

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7324c69ea8c8c2857b2c7c4482c2cc9cb6b1a92847e7cf45b930dc61f39acfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6267815623625658211/index.html?e=69&leftOffset=0&topOffset=0&c=n5XoxQtcIV&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 12:53:18 GMT
x-content-type-options: nosniff
age: 9896
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65288
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 20:35:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 12:53:18 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 716F 43 B
215 B 88ms
88ms Image
image/gif 54.148.97.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1292944&asId=bb62d4d9-8eaa-5234-b2ee-96b2d29a5fff&tv=%7Bc:ucXyuV,time:7594,type:e,im:%7BpLoad:7556%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:7594,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:225,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B7402~0%5D,as:%5B7109~0.0,293~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:203,fm:tVSKPHZ+1111%7C1112%7C112%7C113%7C12%7C13%7C14%7C15*.1292944-76147861%7C151%7C16,idMap:15*,rmeas:1,rend:0,renddet:svg.us,siq:227,sis:337%7D&br=c
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.148.97.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-148-97-220.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://78eab08c4729f76d3dc12d202b4b1e29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Nov 2023 15:38:15 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 249A 17 KB
6 KB 36ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:38:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Nov 2023 15:38:15 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 0210 39 KB
15 KB 36ms
35ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS