urlscan.io logo urlscan.io
SecurityTrails logo

notepad.pw Open in urlscan Pro
151.139.128.10  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://notepad.pw/
Effective URL: https://notepad.pw/1t2i0o1u
Submission: On September 12 via manual from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 5 countries across 10 domains to perform 30 HTTP transactions. The main IP is 151.139.128.10, located in Dallas, United States and belongs to HIGHWINDS3 - Highwinds Network Group, Inc., US. The main domain is notepad.pw.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 25th 2019. Valid for: 3 months.
This is the only time notepad.pw was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 151.139.128.10 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
8 2606:4700::68... 13335 (CLOUDFLAR...)
1 23.111.10.140 33438 (HIGHWINDS2)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 178.128.255.177 14061 (DIGITALOC...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 2606:4700:30:... 13335 (CLOUDFLAR...)
1 94.31.29.32 33438 (HIGHWINDS2)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
30 12
9    151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
notepad.pw
1    2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
8    2606:4700::6813:c797 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com
1    23.111.10.140 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
cdn.carbonads.com
1    2a00:1450:4001:819::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
2    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    178.128.255.177 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: srv-eu-nl-10.buysellads.com
srv.carbonads.net
1    2606:4700::6813:c597 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com
4    2606:4700:30::681f:5c8d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
live.notepad.pw
1    94.31.29.32 (United Kingdom)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
PTR: 94.31.29.32.IPYX-077437-ZYO.above.net
cdn4.buysellads.net
2    2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a00:1450:400c:c06::9c (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
Domain Requested by
9 cdnjs.cloudflare.com notepad.pw
9 notepad.pw 1 redirects notepad.pw
4 live.notepad.pw notepad.pw
2 www.google-analytics.com 1 redirects www.googletagmanager.com
2 fonts.gstatic.com notepad.pw
cdnjs.cloudflare.com
1 stats.g.doubleclick.net notepad.pw
1 cdn4.buysellads.net notepad.pw
1 srv.carbonads.net cdn.carbonads.com
1 www.googletagmanager.com notepad.pw
1 cdn.carbonads.com notepad.pw
1 fonts.googleapis.com notepad.pw
30 11
Subject Issuer Validity Valid
notepad.pw
Sectigo RSA Domain Validation Secure Server CA		 2019-08-25 -
2019-11-23		 3 months crt.sh
*.googleapis.com
GTS CA 1O1		 2019-08-23 -
2019-11-21		 3 months crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-08-10 -
2020-02-16		 6 months crt.sh
*.carbonads.com
COMODO RSA Domain Validation Secure Server CA		 2018-03-12 -
2020-04-08		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-08-23 -
2019-11-21		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-08-23 -
2019-11-21		 3 months crt.sh
*.carbonads.net
COMODO RSA Domain Validation Secure Server CA		 2018-10-13 -
2019-10-13		 a year crt.sh
*.buysellads.net
Sectigo RSA Domain Validation Secure Server CA		 2019-08-23 -
2021-08-22		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-08-23 -
2019-11-21		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://notepad.pw/1t2i0o1u
Frame ID: A899A840F1A7947741EFB71871759019
Requests: 27 HTTP requests in this frame

Frame: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw
Frame ID: 24D9303CE88A4F0C897CE6BEC189A399
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://notepad.pw/ HTTP 307
    https://notepad.pw/1t2i0o1u Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /fbs/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+ionicons(?:\.min)?\.css/i

Page Statistics

30
Requests

100 %
HTTPS

67 %
IPv6

10
Domains

11
Subdomains

12
IPs

5
Countries

448 kB
Transfer

854 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://notepad.pw/ HTTP 307
    https://notepad.pw/1t2i0o1u Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=297433560&t=pageview&_s=1&dl=https%3A%2F%2Fnotepad.pw%2F1t2i0o1u&ul=en-us&de=UTF-8&dt=notepad.pw%20%2F%201t2i0o1u%20%7C%20The%20napkin%20of%20the%20internet.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=822669289&gjid=708527637&cid=714525000.1568299624&tid=UA-52731831-4&_gid=1356219565.1568299624&_r=1&gtm=2ou941&z=1791638373 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-52731831-4&cid=714525000.1568299624&jid=822669289&_gid=1356219565.1568299624&gjid=708527637&_v=j79&z=1791638373

30 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 1t2i0o1u
notepad.pw/
Redirect Chain
  • http://notepad.pw/
  • https://notepad.pw/1t2i0o1u
32 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
ab640d4e061566049ae066bdb2b4433d80ff7eb286b7cc75ac3dd460e297ad34

Request headers

:method
GET
:authority
notepad.pw
:scheme
https
:path
/1t2i0o1u
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
cookie
SPSI=98608b7d515ad61fece20c48648108a8; spcsrf=081cad3377f0b8b1c5441ac5a89061d7; UTGv2=D-h4fa922ce02a6ad55cdc008d3bb47fdd5849; pad_cookie=5f3b65c4abc44c7a8c2bdc2df0cda1bc889d358a; sp_lit=NNcxC6N07vWagiCzK2wQWw==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Thu, 12 Sep 2019 14:47:03 GMT
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
set-cookie
spcsrf=50c72a5b35d6aa7db7e31f6dcd976ca7; Expires=Thu, 12-Sep-19 16:47:03 GMT; Path=/; HttpOnly; SameSite=Strict UTGv2=D-h45a0ed6631c66c9df6e5d80da14f7437794; Expires=Fri, 11-Sep-20 14:47:03 GMT; Path=/ sp_lit=NNcxC6N07vWagiCzK2wQWw==; Expires=Thu, 12-Sep-19 14:52:03 GMT; Path=/; HttpOnly; SameSite=Strict
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
fbs
access-control-allow-origin
*
x-hw
1568299623.cds144.fr8.hn,1568299623.cds035.fr8.sc,1568299623.cdn2-wafbe01-fra1.stackpath.systems.-.wx,1568299623.cds035.fr8.p

Redirect headers

Date
Thu, 12 Sep 2019 14:47:03 GMT
Cache-Control
no-store, no-cache, must-revalidate
Content-Encoding
gzip
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Set-Cookie
SPSI=98608b7d515ad61fece20c48648108a8; Path=/ spcsrf=081cad3377f0b8b1c5441ac5a89061d7; Expires=Thu, 12-Sep-19 16:47:03 GMT; Path=/; HttpOnly; SameSite=Strict adOtr=obsvl; Expires=Thu, 2 Aug 2001 20:47:11 UTC; Path=/ UTGv2=D-h4fa922ce02a6ad55cdc008d3bb47fdd5849; Expires=Fri, 11-Sep-20 14:47:03 GMT; Path=/ pad_cookie=5f3b65c4abc44c7a8c2bdc2df0cda1bc889d358a; expires=Thu, 12-Sep-2019 16:50:36 GMT; Max-Age=7200; path=/; HttpOnly sp_lit=NNcxC6N07vWagiCzK2wQWw==; Expires=Thu, 12-Sep-19 14:52:03 GMT; Path=/; HttpOnly; SameSite=Strict
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Location
https://notepad.pw/1t2i0o1u
Server
fbs
Access-Control-Allow-Origin
*
X-HW
1568299623.cds023.fr8.h2,1568299623.cds136.fr8.sc,1568299623.cdn2-wafbe02-fra1.stackpath.systems.-.wx,1568299623.cds136.fr8.p
Connection
keep-alive
css
fonts.googleapis.com/ 		5 KB
758 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
43bb0a64804a24261d91350f72b92265af1f1dae881f1b6021f219caf83f46f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 12 Sep 2019 14:47:03 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Thu, 12 Sep 2019 14:47:03 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Thu, 12 Sep 2019 14:47:03 GMT
global.css
notepad.pw/content/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://notepad.pw/content/css/global.css?229
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
2b60310189012686567c541c72a40acf74adb416bdc524008822d6c7c73ccd97

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
gzip
last-modified
Mon, 02 Oct 2017 03:48:05 GMT
server
fbs
etag
"59d1b6f5-1821"
status
200
x-hw
1568299623.cds144.fr8.hn,1568299623.cds014.fr8.sc,1568299623.cdn2-redis01-fra1.stackpath.systems.-.wx,1568299623.cds014.fr8.p
content-type
text/css
access-control-allow-origin
*
accept-ranges
bytes
normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/6.0.0/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/normalize/6.0.0/normalize.min.css
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
55b731aa03064189b7abca9931deb7b844c75d7664aacecc1356c4bc0635c4af
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933388
status
200
served-in-seconds
0.000
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:23:10 GMT
server
cloudflare
etag
W/"5afd49fe-8a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8ab0bcbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
ionicons.min.css
cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ 		50 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933541
status
200
served-in-seconds
0.041
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:20:05 GMT
server
cloudflare
etag
W/"5afd4945-c854"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8ab0ecbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
logo-dark.png
notepad.pw/content/images/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://notepad.pw/content/images/logo-dark.png
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
560ee8213cda78828e88fbcbe2fbe6d3337d563384ea57d344ce3e3559da1dda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:04 GMT
last-modified
Thu, 30 Aug 2018 21:59:20 GMT
server
fbs
etag
"5b8868b8-57f4"
status
200
x-hw
1568299623.cds144.fr8.hn,1568299623.cds054.fr8.sc,1568299624.cdn2-wafbe01-fra1.stackpath.systems.-.wx,1568299624.cds054.fr8.p
content-type
image/png
access-control-allow-origin
*
accept-ranges
bytes
content-length
22516
carbon.js
cdn.carbonads.com/ 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.carbonads.com/carbon.js?serve=CK7IT277&placement=notepadpw
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.10.140 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
2b465cb38a82c39337f1b5e8fe543929f58a26e127f0825575f89979c0e37fea

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 12 Sep 2019 14:47:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 10 Jun 2019 17:33:21 GMT
Server
NetDNA-cache/2.2
ETag
W/"9554-58afb9398c5a2"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/ 		82 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933562
status
200
served-in-seconds
0.025
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:21:00 GMT
server
cloudflare
etag
W/"5afd497c-1499c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8ab0fcbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
angular.min.js
cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/ 		156 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/angular.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e92af41ea36051ffe9f3c83abec97cec2ac09cdaa2396863958e8b4bc8de5870
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933408
status
200
served-in-seconds
0.004
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:15:33 GMT
server
cloudflare
etag
W/"5afd4835-27130"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8ab10cbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
angular-cookies.min.js
cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/ 		1 KB
900 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/angular-cookies.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f79dfaabb417f7b777458a24663c5075dd1e56026e20578a0d74568b3c762375
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933408
status
200
served-in-seconds
0.013
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:15:35 GMT
server
cloudflare
etag
W/"5afd4837-5a7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8ab11cbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
socket.io.min.js
cdnjs.cloudflare.com/ajax/libs/socket.io/1.4.8/ 		68 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.4.8/socket.io.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
888b41bb493f82bc787b507deee35df8a9dca32d9f59e5e4434334bb04aa1e17
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933549
status
200
served-in-seconds
0.003
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:26:47 GMT
server
cloudflare
etag
W/"5afd4ad7-10ec3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8ab12cbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
app.min.js
notepad.pw/content/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://notepad.pw/content/js/app.min.js?366
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
c9c41579990e491b31185c662e701facbcd6dab9ec0b06edef8feec2f981812e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:04 GMT
content-encoding
gzip
last-modified
Thu, 30 Aug 2018 22:33:49 GMT
server
fbs
etag
"5b8870cd-2089"
status
200
x-hw
1568299623.cds144.fr8.hn,1568299623.cds093.fr8.sc,1568299624.cdn2-wafbe01-fra1.stackpath.systems.-.wx,1568299624.cds093.fr8.p
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
store.min.js
cdnjs.cloudflare.com/ajax/libs/store.js/1.3.20/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/store.js/1.3.20/store.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d23807344428eec21271b708fcf73919827e568b0a335989f9f2348ae4356bd1
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933551
status
200
served-in-seconds
0.099
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:25:41 GMT
server
cloudflare
etag
W/"5afd4a95-a35"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8bb6ecbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
clipboard.min.js
cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/clipboard.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
12933547
status
200
served-in-seconds
0.007
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:18:30 GMT
server
cloudflare
etag
W/"5afd48e6-2aa5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5152aca8cb87cbc4-VIE
expires
Tue, 01 Sep 2020 14:47:03 GMT
js
www.googletagmanager.com/gtag/ 		69 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-52731831-4
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3ff2918609368f045807222ab5e438077d0a56a425b739aa86453ff24807ffaa
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:03 GMT
content-encoding
br
last-modified
Thu, 12 Sep 2019 12:00:00 GMT
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
26910
x-xss-protection
0
expires
Thu, 12 Sep 2019 14:47:03 GMT
/
notepad.pw/sbbi/ Frame 24D9 		35 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
ea91cad4998daca4ad8ed47f8dbe9420daa383b919fc037ac431e1120d46d977

Request headers

:method
GET
:authority
notepad.pw
:scheme
https
:path
/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://notepad.pw/1t2i0o1u
accept-encoding
gzip, deflate, br
cookie
SPSI=98608b7d515ad61fece20c48648108a8; pad_cookie=5f3b65c4abc44c7a8c2bdc2df0cda1bc889d358a; sp_lit=NNcxC6N07vWagiCzK2wQWw==; spcsrf=50c72a5b35d6aa7db7e31f6dcd976ca7; PRLST=xw; UTGv2=h45a0ed6631c66c9df6e5d80da14f7437794
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://notepad.pw/1t2i0o1u

Response headers

status
200
date
Thu, 12 Sep 2019 14:47:04 GMT
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
server
fbs
x-accel-expires
0
access-control-allow-origin
*
x-hw
1568299624.cds144.fr8.hn,1568299624.cds032.fr8.sc,1568299624.cdn2-wafbe02-fra1.stackpath.systems.-.i,1568299624.cds032.fr8.p
/
notepad.pw/sbbi/ 		43 B
177 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://notepad.pw/sbbi/?sbbpg=utMedia&vii=9h84650a80be7dd6561351acd6661cf9edcfe62e05cd48806d4a81140f87a483i7t7l9n4
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-accel-expires
0
date
Thu, 12 Sep 2019 14:47:04 GMT
server
fbs
status
200
x-hw
1568299624.cds144.fr8.hn,1568299624.cds090.fr8.sc,1568299624.cdn2-wafbe04-fra1.stackpath.systems.-.i,1568299624.cds090.fr8.p
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
o-0IIpQlx3QUlC5A4PNr5TRASf6M7Q.woff2
fonts.gstatic.com/s/notosans/v9/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/notosans/v9/o-0IIpQlx3QUlC5A4PNr5TRASf6M7Q.woff2
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
e56f53b3b976e9c05d86645a1e85cfc69e961601d201e957768455580fa30478
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Origin
https://notepad.pw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 03 Sep 2019 23:47:08 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:20:41 GMT
server
sffe
age
745196
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
10292
x-xss-protection
0
expires
Wed, 02 Sep 2020 23:47:08 GMT
CK7IT277.json
srv.carbonads.net/ads/ 		1 KB
919 B 		Script
General
Check archive.org
Download Go to
Full URL
https://srv.carbonads.net/ads/CK7IT277.json?segment=placement:notepadpw&callback=_carbonads_go
Requested by
Host: cdn.carbonads.com
URL: https://cdn.carbonads.com/carbon.js?serve=CK7IT277&placement=notepadpw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.128.255.177 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
srv-eu-nl-10.buysellads.com
Software
//srv.buysellads.com /
Resource Hash
b70726ebb824790caa3572ebc878e6dd6be5dcd842662ce191dd773d21d49a49

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 12 Sep 2019 14:47:04 GMT
Content-Encoding
gzip
Server
//srv.buysellads.com
Content-Length
712
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
ionicons.ttf
cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/fonts/ 		184 KB
184 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/fonts/ionicons.ttf?v=2.0.0
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css
Origin
https://notepad.pw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:04 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
12933488
status
200
content-length
188508
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:20:05 GMT
server
cloudflare
etag
"5afd4945-2e05c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5152acaa2fc3cb9c-VIE
expires
Tue, 01 Sep 2020 14:47:04 GMT
/
live.notepad.pw/socket.io/ 		101 B
450 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MqbyIRG
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5c8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4af1c5d7b02adfdf5448ced9e07be19082fe95e3f5bb6486c552092922a90618

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:04 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/octet-stream
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
cf-ray
5152acab3ecf8c86-VIE
content-length
101
1563830624-Segment_-_Carbon_new_.png
cdn4.buysellads.net/uu/1/49556/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn4.buysellads.net/uu/1/49556/1563830624-Segment_-_Carbon_new_.png
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.31.29.32 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
94.31.29.32.IPYX-077437-ZYO.above.net
Software
NetDNA-cache/2.2 /
Resource Hash
a85cb087e581a69e09d0354ba5cbaf15e1efe4cfcbbc96954bead06ce3678379

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:04 GMT
last-modified
Mon, 22 Jul 2019 21:23:46 GMT
server
NetDNA-cache/2.2
x-amz-request-id
4B062EA3F612C998
etag
"78a60af225d9d2356cd70b8c06d2d1eb"
x-cache
HIT
content-type
image/png
status
200
cache-control
max-age=31104000
accept-ranges
bytes
content-length
10836
x-amz-id-2
BbiI9nHAfkrxXeOcvvxziWhth4UXtlYVzwM24AX+4EMBmLFWh8bQUzpT9gT4nUtuRAsjDSprpsQ=
expires
Sun, 06 Sep 2020 14:47:04 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-52731831-4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
211
date
Thu, 12 Sep 2019 14:43:33 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17803
expires
Thu, 12 Sep 2019 16:43:33 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=297433560&t=pageview&_s=1&dl=https%3A%2F%2Fnotepad.pw%2F1t2i0o1u&ul=en-us&de=UTF-8&dt=notepad.pw%20%2F%201t2i0o1u%20%7C%20The%20napkin%20of%2...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-52731831-4&cid=714525000.1568299624&jid=822669289&_gid=1356219565.1568299624&gjid=708527637&_v=j79&z=1791638373
35 B
102 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-52731831-4&cid=714525000.1568299624&jid=822669289&_gid=1356219565.1568299624&gjid=708527637&_v=j79&z=1791638373
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 12 Sep 2019 14:47:04 GMT
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 12 Sep 2019 14:47:04 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
302
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-52731831-4&cid=714525000.1568299624&jid=822669289&_gid=1356219565.1568299624&gjid=708527637&_v=j79&z=1791638373
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
417
expires
Fri, 01 Jan 1990 00:00:00 GMT
o-0NIpQlx3QUlC5A4PNjXhFVZNyBx2pqPA.woff2
fonts.gstatic.com/s/notosans/v9/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/notosans/v9/o-0NIpQlx3QUlC5A4PNjXhFVZNyBx2pqPA.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6195b1bce0085db8c9b1b936150dfd7b070aa9be52d44580b1b6f16752dece34
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Origin
https://notepad.pw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 22 Aug 2019 16:14:29 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:20:44 GMT
server
sffe
age
1809155
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
10116
x-xss-protection
0
expires
Fri, 21 Aug 2020 16:14:29 GMT
/
notepad.pw/sbbi/ Frame 24D9 		516 B
460 B 		Document
General
Check archive.org
Download Go to
Full URL
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
Requested by
Host: notepad.pw
URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
d155160aea288964eebe06a362795ab879ed657ca75f7ca60d5a1c8e9fe05d7b

Request headers

:method
POST
:authority
notepad.pw
:scheme
https
:path
/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
content-length
482
pragma
no-cache
cache-control
no-cache
origin
https://notepad.pw
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
accept-encoding
gzip, deflate, br
cookie
SPSI=98608b7d515ad61fece20c48648108a8; pad_cookie=5f3b65c4abc44c7a8c2bdc2df0cda1bc889d358a; sp_lit=NNcxC6N07vWagiCzK2wQWw==; spcsrf=50c72a5b35d6aa7db7e31f6dcd976ca7; PRLST=xw; UTGv2=h45a0ed6631c66c9df6e5d80da14f7437794; adOtr=808b9d65751; typography=%7B%22sp_class%22%3A%22not-active%22%7D; _ga=GA1.2.714525000.1568299624; _gid=GA1.2.1356219565.1568299624; _gat_gtag_UA_52731831_4=1
Origin
https://notepad.pw
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1

Response headers

status
200
date
Thu, 12 Sep 2019 14:47:04 GMT
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
server
fbs
x-accel-expires
0
access-control-allow-origin
*
x-hw
1568299624.cds144.fr8.hn,1568299624.cds004.fr8.sc,1568299624.cdn2-wafbe03-fra1.stackpath.systems.-.i,1568299624.cds004.fr8.p
/
live.notepad.pw/socket.io/ 		5 B
62 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MqbyIUH&sid=wrmCP_ZWv5IcjGs1AA49
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5c8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
25d989b3ed89abc5bb5a814c257dc57619d7f45908013cd08aa508c22e4f6a0a

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:04 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/octet-stream
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
cf-ray
5152acac2f748c86-VIE
content-length
5
/
notepad.pw/sbbi/ Frame 24D9 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw
Requested by
Host: notepad.pw
URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
9727bbdd797f8e5930a228f5df06534372dd2854deb634b9606eff0296233605

Request headers

:method
GET
:authority
notepad.pw
:scheme
https
:path
/sbbi/?sbbpg=sbbShell&gprid=xw
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1
accept-encoding
gzip, deflate, br
cookie
SPSI=98608b7d515ad61fece20c48648108a8; pad_cookie=5f3b65c4abc44c7a8c2bdc2df0cda1bc889d358a; sp_lit=NNcxC6N07vWagiCzK2wQWw==; spcsrf=50c72a5b35d6aa7db7e31f6dcd976ca7; PRLST=xw; UTGv2=h45a0ed6631c66c9df6e5d80da14f7437794; adOtr=808b9d65751; typography=%7B%22sp_class%22%3A%22not-active%22%7D; _ga=GA1.2.714525000.1568299624; _gid=GA1.2.1356219565.1568299624; _gat_gtag_UA_52731831_4=1; __cfduid=da8c971b259a27c5085ae013400a820f01568299624
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=xw&sbbgs=h45a0ed6631c66c9df6e5d80da14f7437794&ddl=1

Response headers

status
200
date
Thu, 12 Sep 2019 14:47:04 GMT
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
server
fbs
x-accel-expires
0
access-control-allow-origin
*
x-hw
1568299624.cds144.fr8.hn,1568299624.cds136.fr8.sc,1568299624.cdn2-wafbe02-fra1.stackpath.systems.-.i,1568299624.cds136.fr8.p
/
live.notepad.pw/socket.io/ 		2 B
72 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MqbyIWG&sid=wrmCP_ZWv5IcjGs1AA49
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5c8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain;charset=UTF-8

Response headers

cf-ray
5152acacf80f8c86-VIE
date
Thu, 12 Sep 2019 14:47:04 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
text/html
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
content-encoding
br
/
live.notepad.pw/socket.io/ 		4 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MqbyIWG.0&sid=wrmCP_ZWv5IcjGs1AA49
Requested by
Host: notepad.pw
URL: https://notepad.pw/1t2i0o1u
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5c8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9a2f1dd042cb6f1eded53dc0a1c66ed8694fc093dc3520cdac1a541d615d474

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/1t2i0o1u
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Sep 2019 14:47:04 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/octet-stream
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
cf-ray
5152acacf8118c86-VIE
content-length
4

Verdicts & Comments Add Verdict or Comment

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| sbbvscc string| sbbgscc function| genPid function| nsbbfetch function| sbbgc function| addmg function| addprid function| sbbeccf function| m2vr function| sbbls string| y string| x string| gprid object| sbbeccfi string| sbbgs object| _carbonads function| _carbonads_go object| _carbon_where string| ignoretargeting function| _bsap_serving_callback function| $ function| jQuery object| angular number| lX number| lY string| csr object| otr object| cnv string| lk__ function| setUGEvals number| tt number| sbbtstflgsbbhbka boolean| sbbhbka function| io boolean| note_created boolean| password_set number| caret string| pad_key string| url_key number| version function| checkEnter function| swapsheets object| app object| store function| gtag object| dataLayer function| initiate_localStorage function| update_localStorage string| input_value string| zSAEYNMkMfis string| VTjEXVFsgQ number| tDcJIhXBZv number| VhnCGFSoUJ number| VFJyhpcwZL number| dDFxArlPjV function| lMtRvsgVod object| LZCBGEpKIH number| c2 number| c1 object| laetYCxExUXQ function| xIGzspHpRG object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData boolean| sbrmp

11 Cookies

Domain/Path Name / Value
.notepad.pw/ Name: _gat_gtag_UA_52731831_4
Value: 1
.notepad.pw/ Name: _gid
Value: GA1.2.1356219565.1568299624
.notepad.pw/ Name: _ga
Value: GA1.2.714525000.1568299624
notepad.pw/ Name: typography
Value: %7B%22sp_class%22%3A%22not-active%22%7D
notepad.pw/ Name: adOtr
Value: 808b9d65751
notepad.pw/ Name: UTGv2
Value: h45a0ed6631c66c9df6e5d80da14f7437794
notepad.pw/ Name: PRLST
Value: xw
notepad.pw/ Name: pad_cookie
Value: 5f3b65c4abc44c7a8c2bdc2df0cda1bc889d358a
notepad.pw/ Name: spcsrf
Value: 50c72a5b35d6aa7db7e31f6dcd976ca7
notepad.pw/ Name: sp_lit
Value: NNcxC6N07vWagiCzK2wQWw==
notepad.pw/ Name: SPSI
Value: 98608b7d515ad61fece20c48648108a8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.carbonads.com
cdn4.buysellads.net
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
live.notepad.pw
notepad.pw
srv.carbonads.net
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
151.139.128.10
178.128.255.177
23.111.10.140
2606:4700:30::681f:5c8d
2606:4700::6813:c597
2606:4700::6813:c797
2a00:1450:4001:809::200a
2a00:1450:4001:819::2008
2a00:1450:4001:825::2003
2a00:1450:4001:825::200e
2a00:1450:400c:c06::9c
94.31.29.32
0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
25d989b3ed89abc5bb5a814c257dc57619d7f45908013cd08aa508c22e4f6a0a
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2b465cb38a82c39337f1b5e8fe543929f58a26e127f0825575f89979c0e37fea
2b60310189012686567c541c72a40acf74adb416bdc524008822d6c7c73ccd97
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
3ff2918609368f045807222ab5e438077d0a56a425b739aa86453ff24807ffaa
43bb0a64804a24261d91350f72b92265af1f1dae881f1b6021f219caf83f46f3
4af1c5d7b02adfdf5448ced9e07be19082fe95e3f5bb6486c552092922a90618
55b731aa03064189b7abca9931deb7b844c75d7664aacecc1356c4bc0635c4af
560ee8213cda78828e88fbcbe2fbe6d3337d563384ea57d344ce3e3559da1dda
6195b1bce0085db8c9b1b936150dfd7b070aa9be52d44580b1b6f16752dece34
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
888b41bb493f82bc787b507deee35df8a9dca32d9f59e5e4434334bb04aa1e17
9727bbdd797f8e5930a228f5df06534372dd2854deb634b9606eff0296233605
a85cb087e581a69e09d0354ba5cbaf15e1efe4cfcbbc96954bead06ce3678379
a9a2f1dd042cb6f1eded53dc0a1c66ed8694fc093dc3520cdac1a541d615d474
ab640d4e061566049ae066bdb2b4433d80ff7eb286b7cc75ac3dd460e297ad34
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b70726ebb824790caa3572ebc878e6dd6be5dcd842662ce191dd773d21d49a49
c9c41579990e491b31185c662e701facbcd6dab9ec0b06edef8feec2f981812e
d155160aea288964eebe06a362795ab879ed657ca75f7ca60d5a1c8e9fe05d7b
d23807344428eec21271b708fcf73919827e568b0a335989f9f2348ae4356bd1
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa
e56f53b3b976e9c05d86645a1e85cfc69e961601d201e957768455580fa30478
e92af41ea36051ffe9f3c83abec97cec2ac09cdaa2396863958e8b4bc8de5870
ea91cad4998daca4ad8ed47f8dbe9420daa383b919fc037ac431e1120d46d977
f79dfaabb417f7b777458a24663c5075dd1e56026e20578a0d74568b3c762375