notepad.pw Open in urlscan Pro
151.139.128.10 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://notepad.pw/
Effective URL:
https://notepad.pw/d00ipo2g
Submission: On February 22 via api (February 22nd 2020, 9:28:05 pm UTC) from US

Summary HTTP 98 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 29 IPs in 5 countries across 24 domains to perform 98 HTTP transactions. The main IP is 151.139.128.10, located in Dallas, United States and belongs to HIGHWINDS3, US. The main domain is notepad.pw.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 25th 2019. Valid for: 3 months.

This is the only time notepad.pw was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 10	151.139.128.10 151.139.128.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE)
9	2606:4700::68... 2606:4700::6811:4104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.198.80.134 192.198.80.134	31863 (DACEN-2) (DACEN-2)
1	2a00:1450:400... 2a00:1450:4001:81f::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700:20:... 2606:4700:20::681a:8b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
4	2606:4700:303... 2606:4700:3036::681f:5d8d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
3	35.188.71.214 35.188.71.214	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
5	216.58.207.66 216.58.207.66	15169 (GOOGLE) (GOOGLE)
3	151.101.113.194 151.101.113.194	54113 (FASTLY) (FASTLY)
3	35.226.36.58 35.226.36.58	15169 (GOOGLE) (GOOGLE)
2	35.226.134.247 35.226.134.247	15169 (GOOGLE) (GOOGLE)
4	37.252.173.27 37.252.173.27	29990 (ASN-APPNEX) (ASN-APPNEX)
4	104.16.190.66 104.16.190.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	54.77.245.4 54.77.245.4	16509 (AMAZON-02) (AMAZON-02)
4	18.197.234.227 18.197.234.227	16509 (AMAZON-02) (AMAZON-02)
2	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	5.178.65.245 5.178.65.245	50673 (SERVERIUS-AS) (SERVERIUS-AS)
9	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:81a::2001	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:821::2004	15169 (GOOGLE) (GOOGLE)
1	23.37.55.184 23.37.55.184	16625 (AKAMAI-AS) (AKAMAI-AS)
4 4	52.212.184.249 52.212.184.249	16509 (AMAZON-02) (AMAZON-02)
5	54.76.246.227 54.76.246.227	16509 (AMAZON-02) (AMAZON-02)
2	151.101.113.108 151.101.113.108	54113 (FASTLY) (FASTLY)
2 2	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
2 2	185.33.223.80 185.33.223.80	29990 (ASN-APPNEX) (ASN-APPNEX)
3 3	52.29.2.234 52.29.2.234	16509 (AMAZON-02) (AMAZON-02)
1 1	94.130.165.158 94.130.165.158	24940 (HETZNER-AS) (HETZNER-AS)
98	29

10 151.139.128.10 (Dallas, United States) 1 redirects

ASN20446 (HIGHWINDS3, US)

notepad.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6811:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.198.80.134 (Lenoir, United States)

ASN31863 (DACEN-2, US)

wpcc.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:8b (United States)

ASN13335 (CLOUDFLARENET, US)

a.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3036::681f:5d8d (United States)

ASN13335 (CLOUDFLARENET, US)

live.notepad.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.188.71.214 (United States)

ASN15169 (GOOGLE, US)
PTR: 214.71.188.35.bc.googleusercontent.com

d.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s25-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.113.194 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

confiant-integrations.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.226.36.58 (United States)

ASN15169 (GOOGLE, US)
PTR: 58.36.226.35.bc.googleusercontent.com

c.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.226.134.247 (United States)

ASN15169 (GOOGLE, US)
PTR: 247.134.226.35.bc.googleusercontent.com

prebid.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.252.173.27 (Ascension Island)

ASN29990 (ASN-APPNEX, US)
PTR: 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.16.190.66 (United States)

ASN13335 (CLOUDFLARENET, US)

dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.77.245.4 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-245-4.eu-west-1.compute.amazonaws.com

g2.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.197.234.227 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-234-227.eu-central-1.compute.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 5.178.65.245 (Renswoude, Netherlands) 1 redirects

ASN50673 (SERVERIUS-AS, NL)
PTR: ads.us.e-planning.net

ads.us.e-planning.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:81a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.55.184 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-55-184.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.212.184.249 (Dublin, Ireland) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-184-249.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.76.246.227 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-246-227.eu-west-1.compute.amazonaws.com

rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.113.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.130 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.223.80 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.29.2.234 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-2-234.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.130.165.158 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.158.165.130.94.clients.your-server.de

bidswitch-eu.splicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	notepad.pw 1 redirects notepad.pw live.notepad.pw	63 KB
12	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	57 KB
10	pub.network a.pub.network d.pub.network c.pub.network prebid.pub.network	224 KB
9	gumgum.com g2.gumgum.com rtb.gumgum.com	3 KB
9	cloudflare.com cdnjs.cloudflare.com	301 KB
8	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com secure.adnxs.com	6 KB
8	doubleclick.net 2 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	97 KB
6	ampproject.org cdn.ampproject.org	112 KB
4	adsrvr.org 4 redirects match.adsrvr.org	2 KB
4	sharethrough.com btlr.sharethrough.com	436 B
4	districtm.io dmx.districtm.io cdn.districtm.io	604 B
3	bidswitch.net 3 redirects x.bidswitch.net	1 KB
3	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	3 KB
3	fastly.net confiant-integrations.global.ssl.fastly.net	79 KB
2	e-planning.net 1 redirects ads.us.e-planning.net	376 B
2	google.com 1 redirects adservice.google.com www.google.com	278 B
2	google-analytics.com www.google-analytics.com	18 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	wpcc.io wpcc.io	5 KB
1	splicky.com 1 redirects bidswitch-eu.splicky.com	232 B
1	google.de adservice.google.de	778 B
1	googletagservices.com www.googletagservices.com	15 KB
1	googletagmanager.com www.googletagmanager.com	28 KB
1	googleapis.com fonts.googleapis.com	825 B
98	24

	Domain	Requested by
10	notepad.pw	1 redirects notepad.pw
9	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com notepad.pw cdn.ampproject.org
9	cdnjs.cloudflare.com	notepad.pw
6	cdn.ampproject.org	securepubads.g.doubleclick.net confiant-integrations.global.ssl.fastly.net
5	rtb.gumgum.com	a.pub.network
5	securepubads.g.doubleclick.net	www.googletagservices.com notepad.pw securepubads.g.doubleclick.net
4	match.adsrvr.org	4 redirects
4	btlr.sharethrough.com	notepad.pw
4	g2.gumgum.com	notepad.pw
4	ib.adnxs.com	notepad.pw
4	live.notepad.pw	notepad.pw
3	x.bidswitch.net	3 redirects
3	pagead2.googlesyndication.com	notepad.pw
3	c.pub.network	notepad.pw
3	confiant-integrations.global.ssl.fastly.net	a.pub.network confiant-integrations.global.ssl.fastly.net
3	d.pub.network	notepad.pw
2	secure.adnxs.com	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	acdn.adnxs.com	a.pub.network
2	cdn.districtm.io	a.pub.network
2	ads.us.e-planning.net	1 redirects a.pub.network
2	fastlane.rubiconproject.com	notepad.pw
2	dmx.districtm.io	notepad.pw
2	prebid.pub.network	notepad.pw
2	www.google-analytics.com	www.googletagmanager.com notepad.pw
2	fonts.gstatic.com	notepad.pw cdnjs.cloudflare.com
2	a.pub.network	notepad.pw a.pub.network
2	wpcc.io	notepad.pw
1	bidswitch-eu.splicky.com	1 redirects
1	eus.rubiconproject.com	a.pub.network
1	googleads.g.doubleclick.net	notepad.pw
1	www.google.com	1 redirects
1	adservice.google.com	www.googletagservices.com
1	adservice.google.de	www.googletagservices.com
1	www.googletagservices.com	a.pub.network
1	www.googletagmanager.com	notepad.pw
1	fonts.googleapis.com	notepad.pw
98	37

This site contains links to these domains. Also see Links.

Domain
www.internetcookies.org
notepad-static.s3.amazonaws.com
about.notepad.pw
www.facebook.com
twitter.com
reddit.com

Subject Issuer	Validity	Valid
notepad.pw Sectigo RSA Domain Validation Secure Server CA	`2019-12-25` - `2020-03-24`	3 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-05` - `2020-06-12`	6 months	crt.sh
wpcc.io Let's Encrypt Authority X3	`2020-01-12` - `2020-04-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-11` - `2020-10-09`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.pub.network Go Daddy Secure Certificate Authority - G2	`2019-02-09` - `2020-05-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.freetls.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-12-18` - `2020-12-18`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
districtm.io CloudFlare Inc ECC CA-2	`2019-03-26` - `2020-03-26`	a year	crt.sh
*.gumgum.com Amazon	`2019-07-31` - `2020-08-31`	a year	crt.sh
*.sharethrough.com Amazon	`2019-10-07` - `2020-11-07`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
ads.us.e-planning.net Let's Encrypt Authority X3	`2020-02-21` - `2020-05-21`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
cdn.adnxs.com GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-16` - `2020-05-16`	a year	crt.sh

This page contains 13 frames:

Primary Page: https://notepad.pw/d00ipo2g
Frame ID: 9CB69D608BBCB95D322A8175BC57B872
Requests: 71 HTTP requests in this frame

Frame: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms
Frame ID: C161BC2AFF9989F32CC52ABE9EAF883B
Requests: 3 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Frame ID: 766A8E9689D1ED602F3FC9CAF19FA204
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/207/runner.html
Frame ID: 65AB858E0F4193195D35C542522C606A
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012002112037430/amp4ads-v0.js
Frame ID: 445119A0AB0E79EBED9BC5EAC3816AA9
Requests: 15 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: DD3A18CEC97FEB6EBA348D984C524E89
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=0&gdpr_consent=
Frame ID: F732D96957E12AB15D81433CBDDF8160
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=d7be25a0-414e-4141-9f04-a1eb74952779&t=1584998877
Frame ID: 0EA9E03C40B4C7FCC7CBF6AF14980EB7
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: B87FC0E6632DB8D565A88D0F5A087E37
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=gdv&i=CAESEMmTWLwY-HvE0GQYcEHk-s8&google_cver=1
Frame ID: C3D70673D544F1EDAB40DA3BB758FE76
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: F8009AB684A7F281916B8A5A68C61A41
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=582ddc18-27df-40ab-9fba-4c55a5ecbd79&t=1584998877
Frame ID: 875922B7C30C102664B145799F90BF99
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 1E39D23CA88FC972CBA0995B40330E67
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://notepad.pw/ Page URL
http://notepad.pw/ HTTP 307
https://notepad.pw/d00ipo2g Page URL

Detected technologies

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Fireblade (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /fbs/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Ionicons (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+ionicons(?:\.min)?\.css/i

Page Statistics

98
Requests

98 %
HTTPS

38 %
IPv6

24
Domains

37
Subdomains

29
IPs

5
Countries

1041 kB
Transfer

2639 kB
Size

19
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.internetcookies.org/
Title: Learn more

Search URL Search Domain Scan URL

URL: https://notepad-static.s3.amazonaws.com/Notepad.pw+Terms+of+Use.pdf
Title: Terms

Search URL Search Domain Scan URL

URL: https://about.notepad.pw/
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://notepad.pw/share/v2vtkm171

Search URL Search Domain Scan URL

URL: http://twitter.com/share?text=notepad.pw&url=https://notepad.pw/share/v2vtkm171

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https://notepad.pw/share/v2vtkm171&title=notepad.pw

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://notepad.pw/ Page URL
http://notepad.pw/ HTTP 307
https://notepad.pw/d00ipo2g Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 52

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID

Request Chain 82

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 90

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=ttd&i=d7be25a0-414e-4141-9f04-a1eb74952779&t=1584998877

Request Chain 92

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_cm&google_sc&google_dbm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_cm=&google_sc=&google_dbm=&google_tc= HTTP 302
https://rtb.gumgum.com/usersync?b=gdv&i=CAESEMmTWLwY-HvE0GQYcEHk-s8&google_cver=1

Request Chain 94

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=ttd&i=582ddc18-27df-40ab-9fba-4c55a5ecbd79&t=1584998877

Request Chain 96

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dapn%26i%3D%24UID HTTP 302
https://rtb.gumgum.com/usersync?b=apn&i=1949296223054288106

Request Chain 97

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_983989fe-9ea8-430f-a01a-c5f5734a7abf&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_983989fe-9ea8-430f-a01a-c5f5734a7abf&gdpr=0&gdpr_consent= HTTP 302
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=e620ed48-e03a-4fb0-baf7-4b091421c3fd HTTP 302
https://x.bidswitch.net/sync?dsp_id=311&user_id=&user_group=2&ssp=gumgum2&expires=10&bsw_param=e620ed48-e03a-4fb0-baf7-4b091421c3fd HTTP 302
https://rtb.gumgum.com/usersync?b=bsw&i=e620ed48-e03a-4fb0-baf7-4b091421c3fd

98 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set / Show response
notepad.pw/ 16 KB
8 KB 232ms
205ms Document
text/html 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: http://notepad.pw/
Protocol: HTTP/1.1
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: da718413937e3c42550e86f1304b8d6112dd6adadda78e74c34f25518a9aa3d9

Request headers

Host: notepad.pw
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

Date: Sat, 22 Feb 2020 21:27:48 GMT
Cache-Control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
Content-Encoding: gzip
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Last-Modified: Fri, 02 Jan 1970 08:00:00 GMT
Set-Cookie: DSR=SDDcWrTIoAw2htfnvTAWIzjlnNkdEs4KdiHlHVPDP0Fr/snJ1feb6LTGDoxNwkBaWsa0vU8I3AUA8RD4fiDEbg==; path=/; DCSS=644AE77E32B9BEBE6F957A3A8CC911FEA694143; path=/;
X-Accel-Expires: 0
Server: fbs
Access-Control-Allow-Origin: *
X-HW: 1582406867.cds001.wa1.h2,1582406867.cds009.wa1.sc,1582406868.cdn2-wafbe04-arn1.stackpath.systems.-.w,1582406868.cds009.wa1.p
Connection: keep-alive

GET
H2

200

Primary Request d00ipo2g Show response
notepad.pw/
Redirect Chain

http://notepad.pw/
https://notepad.pw/d00ipo2g

30 KB
13 KB

495ms
414ms

Document
text/html

151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://notepad.pw/d00ipo2g
Requested by: Host: notepad.pw
URL: http://notepad.pw/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: 6ea6a00dbf1b6e5fc9937a5df4ec036114e38cd7219b037953e471fadaf30e4c

Request headers

:method: GET
:authority: notepad.pw
:scheme: https
:path: /d00ipo2g
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://notepad.pw/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSR=SDDcWrTIoAw2htfnvTAWIzjlnNkdEs4KdiHlHVPDP0Fr/snJ1feb6LTGDoxNwkBaWsa0vU8I3AUA8RD4fiDEbg==; DCSS=644AE77E32B9BEBE6F957A3A8CC911FEA694143; DGCC=NA; DCST=pE9; SPSI=007a15474c46fac16deab7a77822cb08; spcsrf=7287c609cc0bfdc31f8ab542d734894d; UTGv2=D-h49e21ced0ae47eb84b8351447128c201664; pad_cookie=be0599561d35e3085c4340223ff91503748dac16; sp_lit=+AaeXlpSq9TY4rErzktO4g==
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Referer: http://notepad.pw/

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:48 GMT
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
set-cookie: spcsrf=c83c978bd025a25311abb074ec3a4919; path=/; SameSite=Strict; HttpOnly; expires=Sat, 22-Feb-20 23:27:48 GMT UTGv2=D-h4b0fc08cf057aee9ebc0f235a65fd927b76; path=/; expires=Sun, 21-Feb-21 21:27:48 GMT sp_lit=+AaeXlpSq9TY4rErzktO4g==; path=/; SameSite=Strict; HttpOnly; expires=Sat, 22-Feb-20 21:32:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: fbs
access-control-allow-origin: *
x-hw: 1582406868.cds001.wa1.hn,1582406868.cds006.wa1.sc,1582406868.cdn2-redis02-arn1.stackpath.systems.-.wx,1582406868.cds006.wa1.p

Redirect headers

Date: Sat, 22 Feb 2020 21:27:48 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Encoding: gzip
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Set-Cookie: DCST=pE9; path=/; HttpOnly; SPSI=007a15474c46fac16deab7a77822cb08; path=/; spcsrf=7287c609cc0bfdc31f8ab542d734894d; path=/; SameSite=Strict; HttpOnly; expires=Sat, 22-Feb-20 23:27:48 GMT adOtr=obsvl; path=/; expires=Thu, 2 Aug 2001 20:47:11 UTC UTGv2=D-h49e21ced0ae47eb84b8351447128c201664; path=/; expires=Sun, 21-Feb-21 21:27:48 GMT pad_cookie=be0599561d35e3085c4340223ff91503748dac16; expires=Sat, 22-Feb-2020 23:37:48 GMT; Max-Age=7200; path=/; HttpOnly sp_lit=+AaeXlpSq9TY4rErzktO4g==; path=/; SameSite=Strict; HttpOnly; expires=Sat, 22-Feb-20 21:32:48 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Location: https://notepad.pw/d00ipo2g
Server: fbs
Access-Control-Allow-Origin: *
X-HW: 1582406868.cds001.wa1.h2,1582406868.cds008.wa1.sc,1582406868.cdn2-redis01-arn1.stackpath.systems.-.wx,1582406868.cds008.wa1.p
Connection: keep-alive

GET
H2 200 css
fonts.googleapis.com/ 5 KB
825 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto+Sans:400,700

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

68f05f2351faf6a2f45d821bfd6f77af677f4e5e0c087d5ca8d47c1863631f80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 22 Feb 2020 21:27:48 GMT
server: ESF
date: Sat, 22 Feb 2020 21:27:48 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 22 Feb 2020 21:27:48 GMT

GET
H2 200 global.css
notepad.pw/content/css/ 6 KB
2 KB 402ms
401ms Stylesheet
text/css 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://notepad.pw/content/css/global.css?229
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: 2b60310189012686567c541c72a40acf74adb416bdc524008822d6c7c73ccd97

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: gzip
last-modified: Mon, 02 Oct 2017 03:48:05 GMT
server: fbs
etag: "59d1b6f5-1821"
status: 200
x-hw: 1582406868.cds001.wa1.hn,1582406868.cds001.wa1.sc,1582406869.cdn2-redis02-arn1.stackpath.systems.-.wx,1582406869.cds001.wa1.p
content-type: text/css
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/6.0.0/ 2 KB
1 KB 29ms
15ms Stylesheet
text/css 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/normalize/6.0.0/normalize.min.css

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55b731aa03064189b7abca9931deb7b844c75d7664aacecc1356c4bc0635c4af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 14353061
cf-ray: 56940bd33c1c6443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:24:31 GMT
server: cloudflare
etag: W/"5afd4a4f-8a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.001

GET
H2 200 ionicons.min.css
cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ 50 KB
7 KB 37ms
24ms Stylesheet
text/css 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 9901095
cf-ray: 56940bd33c1d6443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:20:52 GMT
server: cloudflare
etag: W/"5afd4974-c854"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.002

GET
H2 200 logo-dark.png
notepad.pw/content/images/ 22 KB
22 KB 436ms
436ms Image
image/png 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://notepad.pw/content/images/logo-dark.png
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: 560ee8213cda78828e88fbcbe2fbe6d3337d563384ea57d344ce3e3559da1dda

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
last-modified: Thu, 30 Aug 2018 21:59:20 GMT
server: fbs
etag: "5b8868b8-57f4"
status: 200
x-hw: 1582406868.cds001.wa1.hn,1582406869.cds011.wa1.sc,1582406869.cdn2-redis02-arn1.stackpath.systems.-.wx,1582406869.cds011.wa1.p
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
content-length: 22516

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/ 82 KB
28 KB 32ms
19ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 9901094
cf-ray: 56940bd33c1e6443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:21:00 GMT
server: cloudflare
etag: W/"5afd497c-1499c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.003

GET
H2 200 angular.min.js Show response
cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/ 156 KB
53 KB 19ms
19ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/angular.min.js

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e92af41ea36051ffe9f3c83abec97cec2ac09cdaa2396863958e8b4bc8de5870

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 9901095
cf-ray: 56940bd36c2f6443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:15:33 GMT
server: cloudflare
etag: W/"5afd4835-27130"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.004

GET
H2 200 angular-cookies.min.js Show response
cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/ 1 KB
845 B 11ms
11ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/angular-cookies.min.js

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f79dfaabb417f7b777458a24663c5075dd1e56026e20578a0d74568b3c762375

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 27040792
cf-ray: 56940bd39c3e6443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:15:35 GMT
server: cloudflare
etag: W/"5afd4837-5a7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.006

GET
H2 200 socket.io.min.js Show response
cdnjs.cloudflare.com/ajax/libs/socket.io/1.4.8/ 68 KB
21 KB 21ms
21ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.4.8/socket.io.min.js

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

888b41bb493f82bc787b507deee35df8a9dca32d9f59e5e4434334bb04aa1e17

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 15933881
cf-ray: 56940bd3ac466443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:26:47 GMT
server: cloudflare
etag: W/"5afd4ad7-10ec3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.003

GET
H2 200 app.min.js Show response
notepad.pw/content/js/ 8 KB
3 KB 413ms
413ms Script
application/javascript 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://notepad.pw/content/js/app.min.js?366
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: c9c41579990e491b31185c662e701facbcd6dab9ec0b06edef8feec2f981812e

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: gzip
last-modified: Thu, 30 Aug 2018 22:33:49 GMT
server: fbs
etag: "5b8870cd-2089"
status: 200
x-hw: 1582406869.cds001.wa1.hn,1582406869.cds011.wa1.sc,1582406869.cdn2-wafbe01-arn1.stackpath.systems.-.wx,1582406869.cds011.wa1.p
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 store.min.js Show response
cdnjs.cloudflare.com/ajax/libs/store.js/1.3.20/ 3 KB
1 KB 14ms
13ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/store.js/1.3.20/store.min.js

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d23807344428eec21271b708fcf73919827e568b0a335989f9f2348ae4356bd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 1343181
cf-ray: 56940bd5ad4f6443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:26:51 GMT
server: cloudflare
etag: W/"5afd4adb-a35"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.001

GET
H2 200 clipboard.min.js Show response
cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/ 11 KB
3 KB 14ms
13ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/clipboard.min.js

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: HIT
age: 9901093
cf-ray: 56940bd5ad516443-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:18:33 GMT
server: cloudflare
etag: W/"5afd48e9-2aa5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.001

GET
H2 200 cookieconsent.min.css
wpcc.io/lib/1.0.2/ 4 KB
1 KB 378ms
116ms Stylesheet
text/css 192.198.80.134
DACEN-2

General

Check archive.org

Show headers Download Go to

Full URL

https://wpcc.io/lib/1.0.2/cookieconsent.min.css

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.198.80.134 Lenoir, United States, ASN31863 (DACEN-2, US),

Reverse DNS

Software

Apache/2 /

Resource Hash

119351ced3134718cb42591e513ff063cf04af7c2734b137c666ee62e137e15d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1119
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Apr 2019 15:44:29 GMT
server: Apache/2
x-frame-options: SAMEORIGIN
etag: "fbe-585ca5cb7f140-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
expires: Mon, 23 Mar 2020 21:27:49 GMT

GET
H2 200 cookieconsent.min.js Show response
wpcc.io/lib/1.0.2/ 9 KB
3 KB 378ms
116ms Script
application/javascript 192.198.80.134
DACEN-2

General

Check archive.org

Show headers Download Go to

Full URL

https://wpcc.io/lib/1.0.2/cookieconsent.min.js

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.198.80.134 Lenoir, United States, ASN31863 (DACEN-2, US),

Reverse DNS

Software

Apache/2 /

Resource Hash

7870dceaf72f9d91b2790eadc462ec110e11be8f265d9394e6f7430d11d05cfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3237
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 01 May 2019 13:31:59 GMT
server: Apache/2
x-frame-options: SAMEORIGIN
etag: "228a-587d38abc51c0-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=2592000
accept-ranges: bytes
expires: Mon, 23 Mar 2020 21:27:49 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-153530698-1

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

afae9d3365270277370ac3d71ccfa3634abd088bdaf2503ee62e6defffe3481e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28493
x-xss-protection: 0
last-modified: Sat, 22 Feb 2020 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 22 Feb 2020 21:27:49 GMT

GET
H2 200 pubfig.min.js Show response
a.pub.network/notepad-pw/ 410 KB
116 KB 416ms
398ms Script
application/javascript 2606:4700:20::681a:8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.pub.network/notepad-pw/pubfig.min.js
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 756912e6148976f1216596bc4811050328b9de2109154bb207cebd7ed8e33145

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: br
cf-cache-status: REVALIDATED
status: 200
x-guploader-uploadid: AEnB2Uoo7amOkfKAKjoP9XdQGdipuRJcTF8PgD0bz5qgcazuFBN-Fq7bZc9FqQqY-rkNL-AartIHNCUS0wW0CWo8dcytSmQRyw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
last-modified: Fri, 14 Feb 2020 16:39:17 GMT
server: cloudflare
etag: W/"da8e91667d35ecc616d5a262fdda0c16"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=EUcjbw==, md5=2o6RZn017MYW1aJi/doMFg==
content-type: application/javascript
x-goog-generation: 1581698357453246
cache-control: public, max-age=1800
x-goog-stored-content-length: 420034
cf-ray: 56940bd5c8d90eaf-FRA
expires: Sat, 22 Feb 2020 21:28:49 GMT

GET
H2 200 / Show response
notepad.pw/sbbi/ Frame C161 25 KB
11 KB 77ms
76ms Document
text/html 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: 02ba22c7c94224dbb55e3ea551769d26fd1a713b9b330bda4b7308546ec42360

Request headers

:method: GET
:authority: notepad.pw
:scheme: https
:path: /sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSR=SDDcWrTIoAw2htfnvTAWIzjlnNkdEs4KdiHlHVPDP0Fr/snJ1feb6LTGDoxNwkBaWsa0vU8I3AUA8RD4fiDEbg==; DCSS=644AE77E32B9BEBE6F957A3A8CC911FEA694143; DGCC=NA; DCST=pE9; SPSI=007a15474c46fac16deab7a77822cb08; pad_cookie=be0599561d35e3085c4340223ff91503748dac16; sp_lit=+AaeXlpSq9TY4rErzktO4g==; spcsrf=c83c978bd025a25311abb074ec3a4919; PRLST=Ms; UTGv2=h4b0fc08cf057aee9ebc0f235a65fd927b76
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:49 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
access-control-allow-origin: *
x-hw: 1582406869.cds001.wa1.hn,1582406869.cds011.wa1.sc,1582406869.cdn2-redis02-arn1.stackpath.systems.-.i,1582406869.cds011.wa1.p

GET
H2 200 /
notepad.pw/sbbi/ 43 B
167 B 182ms
182ms Image
image/gif 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://notepad.pw/sbbi/?sbbpg=utMedia&vii=0h047ba01f5c40784ccf4065f7aace1e69deebacb07fa273758a2625cfbd0982w7lbl7g6
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

x-accel-expires: 0
date: Sat, 22 Feb 2020 21:27:49 GMT
server: fbs
status: 200
x-hw: 1582406869.cds001.wa1.hn,1582406869.cds010.wa1.sc,1582406869.cdn2-wafbe01-arn1.stackpath.systems.-.i,1582406869.cds010.wa1.p
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0

GET
H2 200 ionicons.ttf
cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/fonts/ 184 KB
185 KB 29ms
15ms Font
application/octet-stream 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/fonts/ionicons.ttf?v=2.0.0

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css
Origin: https://notepad.pw
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
cf-cache-status: HIT
age: 27040803
cf-ray: 56940bd5cb42dfd7-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 188508
last-modified: Thu, 17 May 2018 09:20:52 GMT
server: cloudflare
etag: "5afd4974-2e05c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
expires: Thu, 11 Feb 2021 21:27:49 GMT
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
served-in-seconds: 0.018

GET
H2 200 o-0IIpQlx3QUlC5A4PNr5TRA.woff2
fonts.gstatic.com/s/notosans/v9/ 16 KB
16 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosans/v9/o-0IIpQlx3QUlC5A4PNr5TRA.woff2

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a9f53c02752e79270686f1b2a3616b86d3af1ea2a288f2977e34b1141d552ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Origin: https://notepad.pw
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 01 Feb 2020 12:17:21 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:20:51 GMT
server: sffe
age: 1847428
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 16056
x-xss-protection: 0
expires: Sun, 31 Jan 2021 12:17:21 GMT

POST
H2 200 / Show response
notepad.pw/sbbi/ Frame C161 516 B
459 B 79ms
78ms Document
text/html 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
Requested by: Host: notepad.pw
URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: d155160aea288964eebe06a362795ab879ed657ca75f7ca60d5a1c8e9fe05d7b

Request headers

:method: POST
:authority: notepad.pw
:scheme: https
:path: /sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
content-length: 654
pragma: no-cache
cache-control: no-cache
origin: https://notepad.pw
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSR=SDDcWrTIoAw2htfnvTAWIzjlnNkdEs4KdiHlHVPDP0Fr/snJ1feb6LTGDoxNwkBaWsa0vU8I3AUA8RD4fiDEbg==; DCSS=644AE77E32B9BEBE6F957A3A8CC911FEA694143; DGCC=NA; DCST=pE9; SPSI=007a15474c46fac16deab7a77822cb08; pad_cookie=be0599561d35e3085c4340223ff91503748dac16; sp_lit=+AaeXlpSq9TY4rErzktO4g==; spcsrf=c83c978bd025a25311abb074ec3a4919; PRLST=Ms; UTGv2=h4b0fc08cf057aee9ebc0f235a65fd927b76; adOtr=1a05077444c
Origin: https://notepad.pw
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:49 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
access-control-allow-origin: *
x-hw: 1582406869.cds001.wa1.hn,1582406869.cds004.wa1.sc,1582406869.cdn2-wafbe04-arn1.stackpath.systems.-.i,1582406869.cds004.wa1.p

GET
H2 200 / Show response
notepad.pw/sbbi/ Frame C161 7 KB
3 KB 77ms
77ms Document
text/html 151.139.128.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms
Requested by: Host: notepad.pw
URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: fbs /
Resource Hash: a34c47b991f5ceaace6df3efd1c8ceaab5fa8f7c184d1d7986678a7e2c047d03

Request headers

:method: GET
:authority: notepad.pw
:scheme: https
:path: /sbbi/?sbbpg=sbbShell&gprid=Ms
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSR=SDDcWrTIoAw2htfnvTAWIzjlnNkdEs4KdiHlHVPDP0Fr/snJ1feb6LTGDoxNwkBaWsa0vU8I3AUA8RD4fiDEbg==; DCSS=644AE77E32B9BEBE6F957A3A8CC911FEA694143; DGCC=NA; DCST=pE9; SPSI=007a15474c46fac16deab7a77822cb08; pad_cookie=be0599561d35e3085c4340223ff91503748dac16; sp_lit=+AaeXlpSq9TY4rErzktO4g==; spcsrf=c83c978bd025a25311abb074ec3a4919; PRLST=Ms; UTGv2=h4b0fc08cf057aee9ebc0f235a65fd927b76; adOtr=1a05077444c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=Ms&sbbgs=h4b0fc08cf057aee9ebc0f235a65fd927b76&ddl=1

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:49 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
access-control-allow-origin: *
x-hw: 1582406869.cds001.wa1.hn,1582406869.cds008.wa1.sc,1582406869.cdn2-redis01-arn1.stackpath.systems.-.i,1582406869.cds008.wa1.p

GET
H2 200 / Show response
live.notepad.pw/socket.io/ 101 B
480 B 346ms
315ms XHR
application/octet-stream 2606:4700:3036::681f:5d8d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=N1kpACT
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:5d8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3e64916ba3f0eff3d5537dd5d332b7d6effc104fcaf8e21240542ef68343698

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 22 Feb 2020 21:27:50 GMT
via: 1.1 vegur
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/octet-stream
access-control-allow-origin: https://notepad.pw
access-control-allow-credentials: true
cf-ray: 56940bd86cc00ebb-FRA
content-length: 101

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 5ms
5ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-153530698-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 5959
date: Sat, 22 Feb 2020 19:48:30 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18174
expires: Sat, 22 Feb 2020 21:48:30 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 13ms
13ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=334570998&t=pageview&_s=1&dl=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&ul=en-us&de=UTF-8&dt=notepad.pw%20%2F%20d00ipo2g%20%7C%20The%20napkin%20of%20the%20internet.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=336945051&gjid=408627007&cid=799550536.1582406870&tid=UA-153530698-1&_gid=1186332657.1582406870&_r=1&gtm=2ou2c0&z=581209852

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cookie Show response
d.pub.network/ 36 B
458 B 481ms
118ms XHR
text/plain 35.188.71.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/cookie
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.71.214 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.71.188.35.bc.googleusercontent.com
Software: /
Resource Hash: c06980f96bedeb0f68da04f06cc823dc4120ee0dde161c7f77744fc7728f6257

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

Access-Control-Allow-Origin: https://notepad.pw
Date: Sat, 22 Feb 2020 21:27:50 GMT
Access-Control-Allow-Credentials: true
Content-Length: 36
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain;charset=utf-8

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 43 KB
15 KB 59ms
39ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/notepad-pw/pubfig.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8ea8cc8cc8743fe2b6ebeac9ad4a2e2d761c36cc956a7d0b3203e43d47a8d36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "436 / 538 of 1000 / last-modified: 1582321236"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14539
x-xss-protection: 0
expires: Sat, 22 Feb 2020 21:27:49 GMT

GET
H2 200 prebid-analytics-3.6.0.js Show response
a.pub.network/core/ 338 KB
103 KB 138ms
138ms Script
text/html 2606:4700:20::681a:8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/notepad-pw/pubfig.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a910d1809939ab14b9d05a15c1bc8736f2997bc39b37d576264dfa3b70c9b45

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:50 GMT
content-encoding: br
cf-cache-status: BYPASS
status: 200
x-guploader-uploadid: AEnB2UrZgyEWVlCmLQ3g7DtLlvYETtcaKVDE_ze66HcBcGU0IE9c92JNxG8lRJqUB93BySeqt5P9h3nHqaakLwmkHHgaOgQkiA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
last-modified: Mon, 10 Feb 2020 17:48:09 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=NtYd2Q==, md5=QRGG5MzqUJfSkUH1MbEZLw==
content-type: text/html
x-goog-generation: 1581356889589820
cache-control: private
x-goog-stored-content-length: 346359
cf-ray: 56940bd8b8040eaf-FRA
expires: Sun, 21 Feb 2021 21:27:49 GMT

GET
H/1.1 200
OK location Show response
d.pub.network/ 51 B
484 B 483ms
118ms XHR
application/json 35.188.71.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/location
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.71.214 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.71.188.35.bc.googleusercontent.com
Software: /
Resource Hash: 6358c6ea8da1fcf2fc88c991a803c1a5f63b13247d7c546f1e3365ce17ec484d

Request headers

Accept: application/json, text/plain, */*
Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

Access-Control-Allow-Origin: https://notepad.pw
Date: Sat, 22 Feb 2020 21:27:50 GMT
Access-Control-Allow-Credentials: true
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding: chunked
Content-Type: application/json

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
778 B 45ms
18ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=notepad.pw

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=notepad.pw

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020021802.js Show response
securepubads.g.doubleclick.net/gpt/ 167 KB
61 KB 108ms
30ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020021802.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

sffe /

Resource Hash

06c08e3ba81a0a899a551a554791954c7b40ff431de2c6a206e166617578903d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 18 Feb 2020 20:41:43 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 62262
x-xss-protection: 0
expires: Sat, 22 Feb 2020 21:27:50 GMT

GET
H/1.1 200
OK config.js Show response
confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/ 153 KB
33 KB 63ms
21ms Script
text/javascript 151.101.113.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/notepad-pw/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dbe5d86da8a2f186327e3724fe6bb9aa84acac6ea59d5048d3a66a257fd834bf

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sat, 22 Feb 2020 21:27:50 GMT
Content-Encoding: gzip
Age: 3100
X-Cache: HIT
Connection: keep-alive
Content-Length: 33480
x-amz-id-2: wDATSSZ5gf4ErbU0kxmwVEMs51lUIYuLCZa8XXouaGK1JNlAi3LSn4K5aIQ2r5+AxdaMD9yH2dw=
X-Served-By: cache-hhn4069-HHN
Last-Modified: Sat, 22 Feb 2020 20:08:47 GMT
Server: AmazonS3
X-Timer: S1582406870.134941,VS0,VE0
ETag: "efd569a32caafe39190bc213c1b5c909"
x-amz-request-id: FF42700DBF019CD9
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: text/javascript
X-Cache-Hits: 214

GET
H/1.1 200
OK v2 Show response
d.pub.network/floors/ 1 KB
1 KB 373ms
119ms XHR
application/json 35.188.71.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/floors/v2?key=1413desktop
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.71.214 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.71.188.35.bc.googleusercontent.com
Software: /
Resource Hash: a3b9ded1e4401ade5b829f03288ccd0921fe708fe5c20935fad6e6cc9bd01b80

Request headers

Accept: application/json, text/plain, */*
Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

Access-Control-Allow-Origin: https://notepad.pw
Date: Sat, 22 Feb 2020 21:27:50 GMT
Access-Control-Allow-Credentials: true
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding: chunked
Content-Type: application/json

GET
H2 200 / Show response
live.notepad.pw/socket.io/ 5 B
63 B 310ms
309ms XHR
application/octet-stream 2606:4700:3036::681f:5d8d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=N1kpAHw&sid=-ItBpHmZj-bD6fj9Ad6D
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:5d8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25d989b3ed89abc5bb5a814c257dc57619d7f45908013cd08aa508c22e4f6a0a

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 22 Feb 2020 21:27:50 GMT
via: 1.1 vegur
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/octet-stream
access-control-allow-origin: https://notepad.pw
access-control-allow-credentials: true
cf-ray: 56940bda69c00ebb-FRA
content-length: 5

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/gpt/202002111741/ 94 KB
32 KB 20ms
20ms Script
application/javascript 151.101.113.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202002111741/wrap.js
Requested by: Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5cc925a803eea0cf13c9dbc56a885d897a93429a7982412fd0bac3653e36936d

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sat, 22 Feb 2020 21:27:50 GMT
Content-Encoding: gzip
Age: 615
X-Cache: HIT
Connection: keep-alive
Content-Length: 32593
x-amz-id-2: fk17vI3G+bl9jendp357Qd+Jp4QCnTaPHmc7smsQE3UWHRkg7CE5IeNZ/cBAw2GamnjTTMTQg6k=
X-Served-By: cache-hhn4069-HHN
Last-Modified: Thu, 13 Feb 2020 21:03:49 GMT
Server: AmazonS3
X-Timer: S1582406870.176367,VS0,VE0
ETag: "cac43688d7889ff31926c5bf63262683"
x-amz-request-id: 552F12698A03D2F9
Via: 1.1 varnish
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 449

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/prebid/202002111741/ 37 KB
14 KB 46ms
19ms Script
application/javascript 151.101.113.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/prebid/202002111741/wrap.js
Requested by: Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 54a5f6b6e229bcae1a84f6c08614287d0770c96b7d2cfeffe9da6c6c90df2364

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sat, 22 Feb 2020 21:27:50 GMT
Content-Encoding: gzip
Age: 645
X-Cache: HIT
Connection: keep-alive
Content-Length: 13451
x-amz-id-2: DfNMQr58CcxGDUNJNSyuQpv41D2teSZefFkA7I7IhsocDLEp985rdhWuMa5+LmtaYM3yYBwnaMg=
X-Served-By: cache-hhn4069-HHN
Last-Modified: Thu, 13 Feb 2020 21:03:50 GMT
Server: AmazonS3
X-Timer: S1582406870.202623,VS0,VE0
ETag: "c719a162b103ae2c7d189335197ab2f8"
x-amz-request-id: BC333502F8299EE5
Via: 1.1 varnish
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 1273

GET
H2 200 o-0NIpQlx3QUlC5A4PNjXhFVZNyB.woff2
fonts.gstatic.com/s/notosans/v9/ 16 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosans/v9/o-0NIpQlx3QUlC5A4PNjXhFVZNyB.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8beec539128cea621e511cd54f21a0d17ff891a16a0ebd7a98a3e4fbc00bd0e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Origin: https://notepad.pw
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Tue, 04 Feb 2020 16:27:49 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:20:33 GMT
server: sffe
age: 1573201
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 16180
x-xss-protection: 0
expires: Wed, 03 Feb 2021 16:27:49 GMT

POST
H/1.1 200
OK c Show response
c.pub.network/ 36 B
330 B 481ms
118ms XHR
text/plain 35.226.36.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/c
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.36.226.35.bc.googleusercontent.com
Software: /
Resource Hash: c06980f96bedeb0f68da04f06cc823dc4120ee0dde161c7f77744fc7728f6257

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://notepad.pw
Date: Sat, 22 Feb 2020 21:27:50 GMT
Access-Control-Allow-Credentials: true
Content-Length: 36
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain;charset=utf-8

POST
H/1.1 200
OK cookie_sync Show response
prebid.pub.network/ 931 B
688 B 501ms
121ms XHR
application/json 35.226.134.247
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.pub.network/cookie_sync
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.226.134.247 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 247.134.226.35.bc.googleusercontent.com
Software: /
Resource Hash: 09992ba086c488f6b0d0483eb061e2852445e8ce961348c1370e31298a8d1156

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
Content-Type: application/json
access-control-allow-origin: https://notepad.pw
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 421
Expires: 0

POST
H/1.1 200
OK auction Show response
prebid.pub.network/openrtb2/ 162 B
429 B 613ms
211ms XHR
application/json 35.226.134.247
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.pub.network/openrtb2/auction
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.226.134.247 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 247.134.226.35.bc.googleusercontent.com
Software: /
Resource Hash: fddd3fdd993fb91d4ad8f72495501b2e16e3ef27f77bfb65d424d3729282af96

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
Content-Type: application/json
access-control-allow-origin: https://notepad.pw
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 162
Expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 156ms
45ms XHR
application/json 37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

3734ee60e55ff4c3f4e8b9607a84490803ebb5182d4f73e30cabaabcf5b03f58

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Feb 2020 21:27:52 GMT
X-Proxy-Origin: 194.187.251.52; 194.187.251.52; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.89:80
AN-X-Request-Uuid: d1d39c6e-0053-423c-a586-daf52ade5bf7
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://notepad.pw
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
437 B 75ms
36ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

date: Sat, 22 Feb 2020 21:27:50 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://notepad.pw
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 56940bdc8add9beb-AMS
access-control-allow-headers: origin, content-type

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 122 B
648 B 157ms
80ms XHR
application/json 54.77.245.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=14287&pi=3&gdprApplies=0&schain=1.0%2C1!freestar.io%2C1413%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fnotepad.pw&ns=10240&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.245.4 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-245-4.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f763d9814e6eac866a376f2408de1d4164355a2b978d5d3487108679ed015dea

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:50 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://notepad.pw
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 122 B
648 B 149ms
73ms XHR
application/json 54.77.245.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=14288&pi=3&gdprApplies=0&schain=1.0%2C1!freestar.io%2C1413%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fnotepad.pw&ns=10240&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.245.4 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-245-4.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b7fb1692eca620adfc968a594fb92f10e2e266f70f228ecaea9128c461e9c4d9

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:50 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://notepad.pw
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 224ms
124ms XHR
text/plain 18.197.234.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=GrVComq83JzCSLK1pi9waoyR&bidId=154dec0c22eb75f&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%221413%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.234.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-234-227.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

status: 204
date: Sat, 22 Feb 2020 21:27:50 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://notepad.pw
vary: Origin

GET
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 149ms
49ms XHR
text/plain 18.197.234.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=L7rKdgz52e7UZ4fMkwkYmaxf&bidId=16d0146224e8a4a&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%221413%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.234.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-234-227.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

status: 204
date: Sat, 22 Feb 2020 21:27:50 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://notepad.pw
vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 153ms
45ms XHR
application/json 37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

9f4dbe3d33fd24c7fb2bc07468e31b01b1a33e36cb18e52443916709ad3e6cf5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Feb 2020 21:27:52 GMT
X-Proxy-Origin: 194.187.251.52; 194.187.251.52; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.234:80
AN-X-Request-Uuid: 88e41ad7-0d36-48e9-abd6-3aaf802e210a
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://notepad.pw
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 262 B
2 KB 235ms
141ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1498292&size_id=2&alt_size_ids=1%2C55&gdpr=0&rp_schain=1.0,1!freestar.io,1413,1,,,&rf=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&tk_flint=pbjs_lite_v3.6.0&x_source.tid=8b7a536a-b2de-4183-a62e-7c9951b15799&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6095822365188266
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 1f444eb7e1f04d53c7574076db1392e2e79e1fbbf2ebc4bef8202b5229e2703d

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Feb 2020 21:27:50 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://notepad.pw
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 262
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 / Show response
live.notepad.pw/socket.io/ 2 B
73 B 306ms
306ms XHR
text/html 2606:4700:3036::681f:5d8d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=N1kpAMo&sid=-ItBpHmZj-bD6fj9Ad6D
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:5d8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-type: text/plain;charset=UTF-8

Response headers

cf-ray: 56940bdc5e8e0ebb-FRA
date: Sat, 22 Feb 2020 21:27:50 GMT
via: 1.1 vegur
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: text/html
access-control-allow-origin: https://notepad.pw
access-control-allow-credentials: true
content-encoding: br

GET
H2 200 / Show response
live.notepad.pw/socket.io/ 4 B
62 B 375ms
375ms XHR
application/octet-stream 2606:4700:3036::681f:5d8d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=N1kpAMo.0&sid=-ItBpHmZj-bD6fj9Ad6D
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:5d8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9a2f1dd042cb6f1eded53dc0a1c66ed8694fc093dc3520cdac1a541d615d474

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 22 Feb 2020 21:27:50 GMT
via: 1.1 vegur
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/octet-stream
access-control-allow-origin: https://notepad.pw
access-control-allow-credentials: true
cf-ray: 56940bdc5e920ebb-FRA
content-length: 4

GET
H2

200

/
ads.us.e-planning.net/uspd/1/ Frame 766A
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_conse...
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_...

0
0

22ms
22ms

Document
text/html

5.178.65.245
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 5.178.65.245 Renswoude, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash

Request headers

:method: GET
:authority: ads.us.e-planning.net
:scheme: https
:path: /uspd/1/?ct=1&du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: CT=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
server: openresty
date: Sat, 22 Feb 2020 21:27:51 GMT
content-type: text/html
cache-control: max-age=0, no-cache
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
set-cookie: E=M4fdf76a92e6e8d9a; path=/; domain=e-planning.net; expires=Sat, 20-Feb-2027 21:27:51 GMT; SameSite=None; Secure
expires: Sat, 22 Feb 2020 21:27:51 GMT
x-sid: AMS-607
content-encoding: gzip

Redirect headers

status: 302
server: openresty
date: Sat, 22 Feb 2020 21:27:51 GMT
content-type: text/html; charset=iso-8859-1
set-cookie: CT=1; path=/; SameSite=None; Secure
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
location: /uspd/1/?ct=1&du=https%3A%2F%2Fads.us.e-planning.net%2Fgetuid%2F1%2F5a1ad71d2d53a0f5%3Fhttps%3A%2F%2Fprebid.pub.network%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
x-sid: AMS-607

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 432 B
740 B 288ms
287ms XHR
text/plain 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2296905706704049&correlator=2436602961617549&output=ldjh&impl=fifs&adsid=NT&eid=21065304%2C21065305&vrg=2020021802&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200222&iu_parts=15184186%2Cnotepad_970x90_728x90_320x50_320x100_ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60%7C728x90%7C970x90&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1582406871&dt=1582406871062&dlt=1582406868977&idt=1097&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=5&adks=338981424&ucis=1&ifi=1&u_tz=60&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&ref=http%3A%2F%2Fnotepad.pw%2F&dssz=29&icsg=547881728&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x986&msz=1600x70&ga_vid=799550536.1582406870&ga_sid=1582406871&ga_hid=334570998&fws=0&ohw=0

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

456404cdbaaaf3eeba7f39e0c470c29da4bd5d44dc65a50252b2558968f06d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 22 Feb 2020 21:27:51 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 233
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://notepad.pw
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020021802.js Show response
securepubads.g.doubleclick.net/gpt/ 66 KB
24 KB 31ms
31ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020021802.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020021802.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

sffe /

Resource Hash

1a36f0a6f239c7826ac18991fae20560138d016bbd336c5e5156b9ef15ebf523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 18 Feb 2020 20:41:43 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 24891
x-xss-protection: 0
expires: Sat, 22 Feb 2020 21:27:51 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 18ms
6ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020021802.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: empty

Response headers

POST auction
prebid.pub.network/openrtb2/ 0
0

GET
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 177ms
89ms XHR
text/plain 18.197.234.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=GrVComq83JzCSLK1pi9waoyR&bidId=29e7372c08ad52f&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%221413%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.234.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-234-227.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

status: 204
date: Sat, 22 Feb 2020 21:27:51 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://notepad.pw
vary: Origin

GET
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 104ms
89ms XHR
text/plain 18.197.234.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=L7rKdgz52e7UZ4fMkwkYmaxf&bidId=304929c660aa4e4&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%221413%22%2C%22hp%22%3A1%7D%5D%7D&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.234.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-234-227.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

status: 204
date: Sat, 22 Feb 2020 21:27:51 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://notepad.pw
vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 96ms
91ms XHR
application/json 37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

bd55f4e6fa273ca2e798e27ac4a15545ff6ec3fbe5b25bb62fba3c4bc2a399ff

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Feb 2020 21:27:53 GMT
X-Proxy-Origin: 194.187.251.52; 194.187.251.52; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.252:80
AN-X-Request-Uuid: 27d89c26-a437-428c-af6c-43b90917864c
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://notepad.pw
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
167 B 43ms
35ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

date: Sat, 22 Feb 2020 21:27:51 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://notepad.pw
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 56940be359339beb-AMS
access-control-allow-headers: origin, content-type

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 94ms
89ms XHR
application/json 37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

3d1bf1ca1570f665c565b7800297925d324bcc10cd44b15a2b0075f55eefb4a8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Feb 2020 21:27:53 GMT
X-Proxy-Origin: 194.187.251.52; 194.187.251.52; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.42:80
AN-X-Request-Uuid: f7fed137-033c-443d-a26f-087729c72339
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://notepad.pw
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 262 B
1 KB 107ms
101ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1498292&size_id=2&alt_size_ids=1%2C55&gdpr=0&rp_schain=1.0,1!freestar.io,1413,1,,,&rf=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&tk_flint=pbjs_lite_v3.6.0&x_source.tid=56cafdaf-71e5-4330-9877-400a010b5be9&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.21410726299810068
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e80d49a2aed2299308aefe81e21e602545d57d7d66113fb69890e449b0c1a970

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Feb 2020 21:27:51 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://notepad.pw
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 262
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 596 B
651 B 97ms
91ms XHR
application/json 54.77.245.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?pv=3f150baa-0038-4760-b1b4-14ac6593174a&si=14287&pi=3&gdprApplies=0&schain=1.0%2C1!freestar.io%2C1413%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fnotepad.pw&ns=10240&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.245.4 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-245-4.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a1e39468206b17ff0c9efe90cc9aab3e88b8603b62ac4a516269b248745bfa54

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:51 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://notepad.pw
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 493 B
601 B 98ms
92ms XHR
application/json 54.77.245.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?pv=3f150baa-0038-4760-b1b4-14ac6593174a&si=14288&pi=3&gdprApplies=0&schain=1.0%2C1!freestar.io%2C1413%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fnotepad.pw&ns=10240&
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.245.4 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-245-4.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 755b37948ed0e9694ef47577c72db234063c19cb34e57ebcc892eff5d6b6d63f

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:51 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://notepad.pw
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 6 KB
5 KB 36ms
20ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020021802&st=env

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc250bddadf7663d489de0117caa69179ccc57cd4c587b1969630568797db4a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

timing-allow-origin: *
date: Sat, 22 Feb 2020 21:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4727
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 21 KB
8 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020021802.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26656f43f3cc590d12f3158a7aaf595700fe03c57eceb1c700b06d1d71fb1367

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sat, 22 Feb 2020 21:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582236216703523"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 8040
x-xss-protection: 0
expires: Sat, 22 Feb 2020 21:27:51 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/207/ Frame 65AB 0
0 6ms
5ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/207/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/207/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 7203
date: Sat, 22 Feb 2020 20:39:16 GMT
expires: Sun, 21 Feb 2021 20:39:16 GMT
last-modified: Wed, 29 Jan 2020 23:00:55 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2915
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
227 B 16ms
16ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=207&t=2&li=gpt_2020021802&jk=2296905706704049&bg=!eHule2NYW3QOMrT74B0CAAAAMlIAAAAImQFGFrqmY4APUDjtseT4D4ez5uIoraLF7_CwDZ5es5Yea7PhO1D08fS3rEIJAnWWpWiC2_1qMHT2uHmd-2I1dkHD6WCErArb24o2NeitEyll_a57i-cXCrQQPvW4JIHz5BZsszy3XZ-hS4E2AbT8RlXl4CChqRVTZ-xhxUVwYRPrPdj3ZnIwFrq0YudrDvv96IHLGapxEqQgRcPlrzIwkiJ3n9XbXI6c7ZXBo99g3vZH9xwbepsgH9COkHVbUAon568dB2_MMup3KTm2n4KQIXeGufIfdOpuIS7mJnNNAnz9Ln9fkfqRe4jGb7e0E3-HN93ex1UzOjqthdcr-9b6o8kp63mqStpmETCdqb3lWa478kzrK_cMHAo7ae1KLsVsmcThVRJarSuWhliizuuaiAsDW8kNWt1Q3C9O2AFZl8ngxVXI14v9ZyM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:51 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK c Show response
c.pub.network/ 36 B
330 B 118ms
118ms XHR
text/plain 35.226.36.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/c
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.36.226.35.bc.googleusercontent.com
Software: /
Resource Hash: ef8f9d85b82700eaadb4c1e4b2fba05fafd81c476843d2f4063618b3e08d2d11

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://notepad.pw
Date: Sat, 22 Feb 2020 21:27:51 GMT
Access-Control-Allow-Credentials: true
Content-Length: 36
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain;charset=utf-8

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 39 KB
10 KB 282ms
282ms XHR
text/plain 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2296905706704049&correlator=2436602961617549&output=ldjh&impl=fifs&adsid=NT&eid=21065304%2C21065305&vrg=2020021802&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200222&iu_parts=15184186%2Cnotepad_970x90_728x90_320x50_320x100_ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60%7C728x90%7C970x90&rcs=1&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D631db9e63c6e977f%3AT%3D1582406871%3AS%3DALNI_MYWzxtUsYACAJp756-sfYuW3N_iCw&cookie_enabled=1&bc=31&abxe=1&lmt=1582406872&dt=1582406872674&dlt=1582406868977&idt=1097&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=5&adks=338981424&ucis=2&ifi=2&u_tz=60&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnotepad.pw%2Fd00ipo2g&ref=http%3A%2F%2Fnotepad.pw%2F&dssz=30&icsg=550303695616&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x986&msz=1600x70&ga_vid=799550536.1582406870&ga_sid=1582406871&ga_hid=334570998&fws=0&ohw=0

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

5c2af39104027e0d35bbdba5ddeb4a52e8c7589d44c2e92b86d53d912d83cdea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 22 Feb 2020 21:27:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 10114
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://notepad.pw
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012002112037430/ 20 KB
7 KB 34ms
15ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002112037430/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020021802.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3186a55bc67271424c17f202a5797f96d54a851d12249ff7ec152854e4017eb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 7113
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7145
x-xss-protection: 0
server: sffe
date: Sat, 22 Feb 2020 19:29:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5c826442ea1b9f7a"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 21 Feb 2021 19:29:19 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012002112037430/ Frame 4451 201 KB
55 KB 34ms
16ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002112037430/amp4ads-v0.js

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202002111741/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83693e5de36f9cc42f540d09a10978348d85c6e7074a8ba9803e2646df7d95a1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14442
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55865
x-xss-protection: 0
server: sffe
date: Sat, 22 Feb 2020 17:27:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "726cd723e48be406"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 21 Feb 2021 17:27:10 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012002112037430/v0/ Frame 4451 15 KB
6 KB 30ms
12ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002112037430/v0/amp-ad-exit-0.1.js

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202002111741/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ec28887939746f16ae8e7ce9541ee66dd7d76f80350a09ee4677ac6ba41a64b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 102465
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5592
x-xss-protection: 0
server: sffe
date: Fri, 21 Feb 2020 17:00:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "819606326e90ab5d"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Feb 2021 17:00:07 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012002112037430/v0/ Frame 4451 91 KB
28 KB 25ms
7ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002112037430/v0/amp-analytics-0.1.js

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202002111741/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dec9dba8e7c23f46e9b3bca2287a7d6e2d59ad57cc9e8389b7fc00f268b71ca

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14505
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27980
x-xss-protection: 0
server: sffe
date: Sat, 22 Feb 2020 17:26:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1fae760e2b8d4fc0"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 21 Feb 2021 17:26:07 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012002112037430/v0/ Frame 4451 3 KB
1 KB 31ms
13ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002112037430/v0/amp-fit-text-0.1.js

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202002111741/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe26c5e572ef1a563fb95169f7640146a21368e5c1873331e387159fc35477e9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 102545
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1399
x-xss-protection: 0
server: sffe
date: Fri, 21 Feb 2020 16:58:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b97660e69041e328"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Feb 2021 16:58:47 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012002112037430/v0/ Frame 4451 46 KB
15 KB 31ms
13ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002112037430/v0/amp-form-0.1.js

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202002111741/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c470d799d052d3867006566c0a177e3f8290bc64781f45f1d6efd89b16128f56

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 102472
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14831
x-xss-protection: 0
server: sffe
date: Fri, 21 Feb 2020 17:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "cfc894590e2c4834"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Feb 2021 17:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 4451 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 278687d5643ac3f5e2f9d1f845c966768a83522c7f262ba85b4008dad69eed93

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

Content-Type: image/png

GET
H2 200 15325196318142808176
tpc.googlesyndication.com/simgad/ Frame 4451 19 KB
19 KB 7ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15325196318142808176?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnGpa6U_jFxvdfKCzJhbBStSzVtEQ

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403da75a45d56e765b2284b19e3246c7a7e18d883d7ce8dc08bcd4f80a253d61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 21:35:33 GMT
x-content-type-options: nosniff
last-modified: Thu, 18 Apr 2019 13:41:59 GMT
server: sffe
age: 172339
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 18995
x-xss-protection: 0
expires: Fri, 19 Feb 2021 21:35:33 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4451 2 KB
3 KB 6ms
5ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sat, 22 Feb 2020 11:08:58 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 37134
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 23 Feb 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4451 295 B
401 B 6ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: notepad.pw
URL: https://notepad.pw/d00ipo2g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sat, 22 Feb 2020 12:55:21 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 30751
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 23 Feb 2020 12:55:21 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 4451 0
0 45ms
45ms Image
text/html 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CS2Nc2JxRXpigLML47gPipIFQhdOf61uNwsXC9AroqraViwMQASDa18U5YLnovoDUAaABkpmr_ALIAQLgAgCoAwHIAwiqBM8BT9AKZ3yNm_xf2eTPT5rxvsf3BlnH9DzaR5dSgtrA3HUK5mFsvBVGImQaCSg5Jr2i2abHHpFQ6Fl-IM3mKBfLuQZHyd44R__g3WelUGu6_wEdKK045EuQViTSi-G3w99cN6vIR3LT495irSjp_G8uL15lV54llsUsnrNHsV2gv5L6OF4ZFYFYzmJn_S0OIu-EDUUlkvvNXB5_cLcV7XenCzC2jBcBBo04BcdHSpMH9xu6DUwskWNxMytPHpcdHalSlOHI318QM3svcKC4qBbmwATdp62l0QLgBAGSBQQIBBgBkgUECAUYBKAGAoAH1ubUgwGoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQvfYD0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi0zMTQ1OTg0NjgxNTA3Mzk5gAoDyAsB2BMK&sigh=op8DPfYwhMw&tpd=AGWhJmsAQPc_Ivmmn819bxKmXP3gM0IJvNslcyHUjjnv8tq-cA
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s25-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 4451
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

14ms
14ms

Image
text/html

2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

Redirect headers

date: Sat, 22 Feb 2020 21:27:53 GMT
x-content-type-options: nosniff
server: safe
location: https://googleads.g.doubleclick.net/pagead/drt/si
content-type: text/html; charset=UTF-8
status: 302
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 15325196318142808176
tpc.googlesyndication.com/simgad/ Frame 4451 19 KB
19 KB 5ms
5ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15325196318142808176?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnGpa6U_jFxvdfKCzJhbBStSzVtEQ

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002112037430/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403da75a45d56e765b2284b19e3246c7a7e18d883d7ce8dc08bcd4f80a253d61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 21:35:33 GMT
x-content-type-options: nosniff
last-modified: Thu, 18 Apr 2019 13:41:59 GMT
server: sffe
age: 172340
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 18995
x-xss-protection: 0
expires: Fri, 19 Feb 2021 21:35:33 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4451 2 KB
3 KB 7ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002112037430/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sat, 22 Feb 2020 11:08:58 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 37135
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 23 Feb 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4451 295 B
360 B 6ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002112037430/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sat, 22 Feb 2020 12:55:21 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 30752
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 23 Feb 2020 12:55:21 GMT

POST
H/1.1 200
OK c Show response
c.pub.network/ 36 B
330 B 118ms
118ms XHR
text/plain 35.226.36.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/c
Requested by: Host: notepad.pw
URL: https://notepad.pw/d00ipo2g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.226.36.58 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.36.226.35.bc.googleusercontent.com
Software: /
Resource Hash: ef8f9d85b82700eaadb4c1e4b2fba05fafd81c476843d2f4063618b3e08d2d11

Request headers

Referer: https://notepad.pw/d00ipo2g
Origin: https://notepad.pw
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://notepad.pw
Date: Sat, 22 Feb 2020 21:27:53 GMT
Access-Control-Allow-Credentials: true
Content-Length: 36
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain;charset=utf-8

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 4451 42 B
115 B 20ms
19ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvYTXSKjvXSdeTuT92hfb720T9qbYYxJcDaszujiD90rT_grHjl6HIFYmc4Kj8BZoYrf-6Fognj0odVmztK1c6dOl5hhyewKTA9PLZk4VgwYEFz10opSpx3FW_n2g&sai=AMfl-YRz9lP-yTpZJCptSLi_y8LSrF1FSfUVsr0i3whPdFL3GDmXGkUqL16h_4Fcu-FjDvIzhvWPUyLni95wC7KWp0z3UpoiMWycvbPuT3amlirj8Ph1Z_mH-V-oRQ4&sig=Cg0ArKJSzGCAU7EZcAlVEAE&cid=CAASF-Ro1poeYCySAkNiwSM7rnkSOj615QKV&id=ampim&o=436,5&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=112&tls=1112&g=100&h=100&tt=1113&r=v&adk=338981424&avms=ampa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:54 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html
cdn.districtm.io/ids/ Frame DD3A 0
0 131ms
129ms Document
text/html 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.districtm.io/ids/index.html

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:57 GMT
content-type: text/html
set-cookie: __cfduid=d4338bddae37479e06fccf0cb7cca87841582406877; expires=Mon, 23-Mar-20 21:27:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
cf-ray: 56940c05c80f9beb-AMS
cache-control: s-maxage=1209600, max-age=14400
last-modified: Thu, 10 Jan 2019 16:50:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
content-encoding: br

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame F732 0
0 28ms
27ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=0&gdpr_consent=
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://notepad.pw/d00ipo2g
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 12 Feb 2020 18:47:41 GMT
Content-Encoding: gzip
Content-Length: 7693
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=25842
Expires: Sun, 23 Feb 2020 04:38:39 GMT
Date: Sat, 22 Feb 2020 21:27:57 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

usersync
rtb.gumgum.com/ Frame 0EA9
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=d7be25a0-414e-4141-9f04-a1eb74952779&t=1584998877

0
0

39ms
39ms

Document
image/gif

54.76.246.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=d7be25a0-414e-4141-9f04-a1eb74952779&t=1584998877
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.246.227 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-246-227.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: rtb.gumgum.com
:scheme: https
:path: /usersync?b=ttd&i=d7be25a0-414e-4141-9f04-a1eb74952779&t=1584998877
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:57 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

status: 302
date: Sat, 22 Feb 2020 21:27:57 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=d7be25a0-414e-4141-9f04-a1eb74952779&t=1584998877
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
set-cookie: TDID=d7be25a0-414e-4141-9f04-a1eb74952779; domain=.adsrvr.org; expires=Mon, 22-Feb-2021 21:27:57 GMT; path=/; secure; SameSite=None TDCPM=CAEYBSABKAIyCwjWxLONmvqbOBAFOAE.; domain=.adsrvr.org; expires=Mon, 22-Feb-2021 21:27:57 GMT; path=/; secure; SameSite=None
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame B87F 0
0 68ms
25ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.9.13 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://notepad.pw/d00ipo2g
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

Server: nginx/1.9.13
Content-Type: text/html
Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: W/"573e714d-3e3"
Expires: Sun, 06 Aug 2017 09:41:59 GMT
Cache-Control: max-age=31536000
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Fastly-Debug-Digest: e0a1bb88354655bae6b4f44be1ff58238053e5563770e29e0e433e905ee66055
Content-Length: 506
Accept-Ranges: bytes
Date: Sat, 22 Feb 2020 21:27:57 GMT
Age: 17322362
Connection: keep-alive
X-Served-By: cache-jfk8123-JFK, cache-hhn4026-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1276778, 3603810
X-Timer: S1582406877.133514,VS0,VE0
Vary: Accept-Encoding

GET
H2

200

usersync
rtb.gumgum.com/ Frame C3D7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_cm&google_sc&google_dbm
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_cm=&google_sc=&google_dbm=&google_tc=
https://rtb.gumgum.com/usersync?b=gdv&i=CAESEMmTWLwY-HvE0GQYcEHk-s8&google_cver=1

0
0

39ms
39ms

Document
image/gif

54.76.246.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=gdv&i=CAESEMmTWLwY-HvE0GQYcEHk-s8&google_cver=1
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.246.227 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-246-227.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: rtb.gumgum.com
:scheme: https
:path: /usersync?b=gdv&i=CAESEMmTWLwY-HvE0GQYcEHk-s8&google_cver=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:57 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://rtb.gumgum.com/usersync?b=gdv&i=CAESEMmTWLwY-HvE0GQYcEHk-s8&google_cver=1
date: Sat, 22 Feb 2020 21:27:57 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 286
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUlm1u2jNw8q66BLeHXKJTOtMiZzy5rrltqJ7CE4Gm91QZF7FuWZqI29ocri; expires=Thu, 18-Mar-2021 21:27:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame F800 0
0 66ms
26ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.9.13 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://notepad.pw/d00ipo2g
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

Server: nginx/1.9.13
Content-Type: text/html
Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: W/"573e714d-3e3"
Expires: Sun, 06 Aug 2017 09:41:59 GMT
Cache-Control: max-age=31536000
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Fastly-Debug-Digest: e0a1bb88354655bae6b4f44be1ff58238053e5563770e29e0e433e905ee66055
Content-Length: 506
Accept-Ranges: bytes
Date: Sat, 22 Feb 2020 21:27:57 GMT
Age: 17322361
Connection: keep-alive
X-Served-By: cache-jfk8123-JFK, cache-hhn4066-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1276778, 3618925
X-Timer: S1582406877.133630,VS0,VE0
Vary: Accept-Encoding

GET
H2

200

usersync
rtb.gumgum.com/ Frame 8759
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=582ddc18-27df-40ab-9fba-4c55a5ecbd79&t=1584998877

0
0

39ms
39ms

Document
image/gif

54.76.246.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=582ddc18-27df-40ab-9fba-4c55a5ecbd79&t=1584998877
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.246.227 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-246-227.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: rtb.gumgum.com
:scheme: https
:path: /usersync?b=ttd&i=582ddc18-27df-40ab-9fba-4c55a5ecbd79&t=1584998877
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:57 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

status: 302
date: Sat, 22 Feb 2020 21:27:57 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=582ddc18-27df-40ab-9fba-4c55a5ecbd79&t=1584998877
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
set-cookie: TDID=582ddc18-27df-40ab-9fba-4c55a5ecbd79; domain=.adsrvr.org; expires=Mon, 22-Feb-2021 21:27:57 GMT; path=/; secure; SameSite=None TDCPM=CAEYBSABKAIyCwjM9tSGmvqbOBAFOAE.; domain=.adsrvr.org; expires=Mon, 22-Feb-2021 21:27:57 GMT; path=/; secure; SameSite=None
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 index.html
cdn.districtm.io/ids/ Frame 1E39 0
0 119ms
119ms Document
text/html 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.districtm.io/ids/index.html

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-3.6.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://notepad.pw/d00ipo2g
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://notepad.pw/d00ipo2g

Response headers

status: 200
date: Sat, 22 Feb 2020 21:27:57 GMT
content-type: text/html
set-cookie: __cfduid=d4338bddae37479e06fccf0cb7cca87841582406877; expires=Mon, 23-Mar-20 21:27:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
cf-ray: 56940c05d82c9beb-AMS
cache-control: s-maxage=1209600, max-age=14400
last-modified: Thu, 10 Jan 2019 16:50:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
content-encoding: br

GET
H2

200

usersync
rtb.gumgum.com/
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dapn%26i%3D%24UID
https://rtb.gumgum.com/usersync?b=apn&i=1949296223054288106

35 B
237 B

39ms
39ms

Image
image/gif

54.76.246.227
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=1949296223054288106
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.246.227 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-246-227.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:57 GMT
server: nginx
p3p: CP="This is not a P3P policy"
content-type: image/gif;charset=UTF-8
status: 200
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 22 Feb 2020 21:27:59 GMT
AN-X-Request-Uuid: 29821097-b9e3-4022-800b-01a00d0e489a
Content-Type: text/html; charset=utf-8
Server: nginx/1.13.4
Location: https://rtb.gumgum.com/usersync?b=apn&i=1949296223054288106
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 194.187.251.52; 194.187.251.52; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.137:80
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_983989fe-9ea8-430f-a01a-c5f5734a7abf&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_983989fe-9ea8-430f-a01a-c5f5734a7abf&gdpr=0&gdpr_consent=
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=e620ed48-e03a-4fb0-baf7-4b091421c3fd
https://x.bidswitch.net/sync?dsp_id=311&user_id=&user_group=2&ssp=gumgum2&expires=10&bsw_param=e620ed48-e03a-4fb0-baf7-4b091421c3fd
https://rtb.gumgum.com/usersync?b=bsw&i=e620ed48-e03a-4fb0-baf7-4b091421c3fd

35 B
237 B

39ms
39ms

Image
image/gif

54.76.246.227
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=e620ed48-e03a-4fb0-baf7-4b091421c3fd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.246.227 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-246-227.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://notepad.pw/d00ipo2g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

pragma: no-cache
date: Sat, 22 Feb 2020 21:27:57 GMT
server: nginx
p3p: CP="This is not a P3P policy"
content-type: image/gif;charset=UTF-8
status: 200
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

status: 302
date: Sat, 22 Feb 2020 21:27:57 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: //rtb.gumgum.com/usersync?b=bsw&i=e620ed48-e03a-4fb0-baf7-4b091421c3fd
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: prebid.pub.network
URL: https://prebid.pub.network/openrtb2/auction

Verdicts & Comments Add Verdict or Comment

104 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
notepad.pw/	1969-12-31 23:59:59	Name: fsbotchecked Value: true
.notepad.pw/	1970-01-19 07:33:26	Name: _gat_gtag_UA_153530698_1 Value: 1
notepad.pw/	1970-01-19 07:33:28	Name: fssts Value: false
.notepad.pw/	1970-01-19 07:34:53	Name: _gid Value: GA1.2.1186332657.1582406870
.notepad.pw/	1970-01-20 01:04:38	Name: _ga Value: GA1.2.799550536.1582406870
notepad.pw/	1970-01-19 07:47:50	Name: typography Value: %7B%22sp_class%22%3A%22not-active%22%7D
.notepad.pw/	1970-01-19 08:16:38	Name: __cfduid Value: de1f309621d9d6a68c2fa9c7db6a27e8a1582406869
notepad.pw/	1969-12-31 23:59:59	Name: adOtr Value: 1a05077444c
notepad.pw/	1969-12-31 23:59:59	Name: SPSI Value: 007a15474c46fac16deab7a77822cb08
notepad.pw/	1970-01-19 07:33:34	Name: pad_cookie Value: be0599561d35e3085c4340223ff91503748dac16
notepad.pw/	1969-12-31 23:59:59	Name: DCST Value: pE9
notepad.pw/	1970-01-19 07:33:34	Name: spcsrf Value: c83c978bd025a25311abb074ec3a4919
notepad.pw/	1970-01-19 07:33:28	Name: _fssid Value: 12ee9e4c-d0ca-458e-bd2b-3a2b485645e1
notepad.pw/	1970-01-19 07:33:27	Name: sp_lit Value: +AaeXlpSq9TY4rErzktO4g==
notepad.pw/	1969-12-31 23:59:59	Name: DCSS Value: 644AE77E32B9BEBE6F957A3A8CC911FEA694143
notepad.pw/	1969-12-31 23:59:59	Name: PRLST Value: Ms
notepad.pw/	1970-01-19 07:34:53	Name: DGCC Value: NA
notepad.pw/	1970-01-23 06:41:45	Name: UTGv2 Value: h4b0fc08cf057aee9ebc0f235a65fd927b76
notepad.pw/	1969-12-31 23:59:59	Name: DSR Value: SDDcWrTIoAw2htfnvTAWIzjlnNkdEs4KdiHlHVPDP0Fr/snJ1feb6LTGDoxNwkBaWsa0vU8I3AUA8RD4fiDEbg==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/rtv/012002112037430/amp4ads-v0.js(Line 409) Message: Powered by AMP ⚡ HTML – Version 2002112037430 https://notepad.pw/d00ipo2g

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.pub.network
acdn.adnxs.com
ads.us.e-planning.net
adservice.google.com
adservice.google.de
bidswitch-eu.splicky.com
btlr.sharethrough.com
c.pub.network
cdn.ampproject.org
cdn.districtm.io
cdnjs.cloudflare.com
cm.g.doubleclick.net
confiant-integrations.global.ssl.fastly.net
d.pub.network
dmx.districtm.io
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g2.gumgum.com
googleads.g.doubleclick.net
ib.adnxs.com
live.notepad.pw
match.adsrvr.org
notepad.pw
pagead2.googlesyndication.com
prebid.pub.network
rtb.gumgum.com
secure.adnxs.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
wpcc.io
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
prebid.pub.network
104.16.190.66
151.101.113.108
151.101.113.194
151.139.128.10
172.217.16.130
18.197.234.227
185.33.223.80
192.198.80.134
216.58.207.66
23.37.55.184
2606:4700:20::681a:8b
2606:4700:3036::681f:5d8d
2606:4700::6811:4104
2a00:1450:4001:800::200e
2a00:1450:4001:808::2003
2a00:1450:4001:809::2001
2a00:1450:4001:815::2002
2a00:1450:4001:817::2002
2a00:1450:4001:81a::2001
2a00:1450:4001:81f::2008
2a00:1450:4001:81f::200a
2a00:1450:4001:821::2004
2a00:1450:4001:825::2002
35.188.71.214
35.226.134.247
35.226.36.58
37.252.173.27
5.178.65.245
52.212.184.249
52.29.2.234
54.76.246.227
54.77.245.4
69.173.144.140
94.130.165.158
02ba22c7c94224dbb55e3ea551769d26fd1a713b9b330bda4b7308546ec42360
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06c08e3ba81a0a899a551a554791954c7b40ff431de2c6a206e166617578903d
09992ba086c488f6b0d0483eb061e2852445e8ce961348c1370e31298a8d1156
0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062
0ec28887939746f16ae8e7ce9541ee66dd7d76f80350a09ee4677ac6ba41a64b
119351ced3134718cb42591e513ff063cf04af7c2734b137c666ee62e137e15d
1a36f0a6f239c7826ac18991fae20560138d016bbd336c5e5156b9ef15ebf523
1a910d1809939ab14b9d05a15c1bc8736f2997bc39b37d576264dfa3b70c9b45
1f444eb7e1f04d53c7574076db1392e2e79e1fbbf2ebc4bef8202b5229e2703d
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
25d989b3ed89abc5bb5a814c257dc57619d7f45908013cd08aa508c22e4f6a0a
26656f43f3cc590d12f3158a7aaf595700fe03c57eceb1c700b06d1d71fb1367
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
278687d5643ac3f5e2f9d1f845c966768a83522c7f262ba85b4008dad69eed93
2b60310189012686567c541c72a40acf74adb416bdc524008822d6c7c73ccd97
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3734ee60e55ff4c3f4e8b9607a84490803ebb5182d4f73e30cabaabcf5b03f58
3d1bf1ca1570f665c565b7800297925d324bcc10cd44b15a2b0075f55eefb4a8
403da75a45d56e765b2284b19e3246c7a7e18d883d7ce8dc08bcd4f80a253d61
456404cdbaaaf3eeba7f39e0c470c29da4bd5d44dc65a50252b2558968f06d0e
4a9f53c02752e79270686f1b2a3616b86d3af1ea2a288f2977e34b1141d552ec
54a5f6b6e229bcae1a84f6c08614287d0770c96b7d2cfeffe9da6c6c90df2364
55b731aa03064189b7abca9931deb7b844c75d7664aacecc1356c4bc0635c4af
560ee8213cda78828e88fbcbe2fbe6d3337d563384ea57d344ce3e3559da1dda
5c2af39104027e0d35bbdba5ddeb4a52e8c7589d44c2e92b86d53d912d83cdea
5cc925a803eea0cf13c9dbc56a885d897a93429a7982412fd0bac3653e36936d
6358c6ea8da1fcf2fc88c991a803c1a5f63b13247d7c546f1e3365ce17ec484d
68f05f2351faf6a2f45d821bfd6f77af677f4e5e0c087d5ca8d47c1863631f80
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ea6a00dbf1b6e5fc9937a5df4ec036114e38cd7219b037953e471fadaf30e4c
755b37948ed0e9694ef47577c72db234063c19cb34e57ebcc892eff5d6b6d63f
756912e6148976f1216596bc4811050328b9de2109154bb207cebd7ed8e33145
7870dceaf72f9d91b2790eadc462ec110e11be8f265d9394e6f7430d11d05cfb
7dec9dba8e7c23f46e9b3bca2287a7d6e2d59ad57cc9e8389b7fc00f268b71ca
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83693e5de36f9cc42f540d09a10978348d85c6e7074a8ba9803e2646df7d95a1
888b41bb493f82bc787b507deee35df8a9dca32d9f59e5e4434334bb04aa1e17
8beec539128cea621e511cd54f21a0d17ff891a16a0ebd7a98a3e4fbc00bd0e5
9f4dbe3d33fd24c7fb2bc07468e31b01b1a33e36cb18e52443916709ad3e6cf5
a1e39468206b17ff0c9efe90cc9aab3e88b8603b62ac4a516269b248745bfa54
a34c47b991f5ceaace6df3efd1c8ceaab5fa8f7c184d1d7986678a7e2c047d03
a3b9ded1e4401ade5b829f03288ccd0921fe708fe5c20935fad6e6cc9bd01b80
a9a2f1dd042cb6f1eded53dc0a1c66ed8694fc093dc3520cdac1a541d615d474
afae9d3365270277370ac3d71ccfa3634abd088bdaf2503ee62e6defffe3481e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b7fb1692eca620adfc968a594fb92f10e2e266f70f228ecaea9128c461e9c4d9
b8ea8cc8cc8743fe2b6ebeac9ad4a2e2d761c36cc956a7d0b3203e43d47a8d36
bd55f4e6fa273ca2e798e27ac4a15545ff6ec3fbe5b25bb62fba3c4bc2a399ff
c06980f96bedeb0f68da04f06cc823dc4120ee0dde161c7f77744fc7728f6257
c3186a55bc67271424c17f202a5797f96d54a851d12249ff7ec152854e4017eb
c470d799d052d3867006566c0a177e3f8290bc64781f45f1d6efd89b16128f56
c9c41579990e491b31185c662e701facbcd6dab9ec0b06edef8feec2f981812e
d155160aea288964eebe06a362795ab879ed657ca75f7ca60d5a1c8e9fe05d7b
d23807344428eec21271b708fcf73919827e568b0a335989f9f2348ae4356bd1
d3e64916ba3f0eff3d5537dd5d332b7d6effc104fcaf8e21240542ef68343698
da718413937e3c42550e86f1304b8d6112dd6adadda78e74c34f25518a9aa3d9
dbe5d86da8a2f186327e3724fe6bb9aa84acac6ea59d5048d3a66a257fd834bf
dc250bddadf7663d489de0117caa69179ccc57cd4c587b1969630568797db4a4
de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e80d49a2aed2299308aefe81e21e602545d57d7d66113fb69890e449b0c1a970
e92af41ea36051ffe9f3c83abec97cec2ac09cdaa2396863958e8b4bc8de5870
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8f9d85b82700eaadb4c1e4b2fba05fafd81c476843d2f4063618b3e08d2d11
f763d9814e6eac866a376f2408de1d4164355a2b978d5d3487108679ed015dea
f79dfaabb417f7b777458a24663c5075dd1e56026e20578a0d74568b3c762375
fddd3fdd993fb91d4ad8f72495501b2e16e3ef27f77bfb65d424d3729282af96
fe26c5e572ef1a563fb95169f7640146a21368e5c1873331e387159fc35477e9

notepad.pw Open in urlscan Pro 151.139.128.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

98 Requests

98 %HTTPS

38 %IPv6

24 Domains

37 Subdomains

29 IPs

5 Countries

1041 kBTransfer

2639 kBSize

19 Cookies

6 Outgoing links

Page URL History

Redirected requests

98 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

notepad.pw Open in urlscan Pro
151.139.128.10 Public Scan

Screenshot
Live screenshot

Full Image

98
Requests

98 %
HTTPS

38 %
IPv6

24
Domains

37
Subdomains

29
IPs

5
Countries

1041 kB
Transfer

2639 kB
Size

19
Cookies

98 HTTP transactions
1 data transactions