paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRbEs4TlpmVGpNRFdDZmtEMjcxaEstMjYxOS0yNjc0NzY2Ny0xMDFhMDI4MC0zNjg0LUcwdWpxNThTZHVHbEQwbEhrVUts/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 65245
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Thu, 17 Apr 2025 19:37:40 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JS2M3HTQB4WTT8KVXMEE4KQZ

Redirect headers

accept-ranges: bytes
age: 65245
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Thu, 17 Apr 2025 19:37:40 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JS2M3HR7KH98FXNVV75YA9BQ

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 302ms
135ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6ca2e6e84ef3961cac081f7595487d640d41b7da20901fba36e713129eb9233

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 931e60e07d4e2b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 75ms
74ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 65707
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JS2M3HXBECH19EJGD76B14SG
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 76ms
76ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 89716
accept-ranges: bytes
content-length: 1192
x-nf-request-id: 01JS2M3HXBHFX53VFEGJXCRR5E
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 151ms
151ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 685
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JS2M3HXBA8Z7RN7T4TF7TCFZ
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 76ms
76ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 65707
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JS2M3HXBVRQ4YJEZJXZ3SWGS
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 144ms
142ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 65707
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JS2M3HZVQTZGFYDQZ1990JG6
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 150ms
148ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 54609
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JS2M3HZV000SGK74KARC9XK6
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 196ms
109ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7925e42557764f4941818d4731d224710415ccadde3ba9c12eed8afcd78e542f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 931e60e07d502b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
123 KB 486ms
209ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5b68e6ab95129bba0dee4751623972a4b4f04650f532fe7b13e41b8a85bac64e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 19:37:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 125476
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 50530363469658c9e05ec319ddb4f65523e19cefff8e789f.v1.js Show response
faucetfoot.com/files/ 68 KB
25 KB 274ms
95ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/files/50530363469658c9e05ec319ddb4f65523e19cefff8e789f.v1.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

4bebbc78de477aaf548a373689856257d81fe883ca079d754cdf5d314792a8d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"6f9b4c89b1dfc37a44e4b3735bcc5c47b504370d1f6b3bbaeb6ddc48ed642156"
via: fen-hoothoot-us-west1-9vjq.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
33 KB 430ms
154ms Script
text/javascript 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48ee819bccdf85949ee19f0b866a45f9d05afea2f4cbe2e454399647667ae2d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 625 / 20195 / 31091816 / config-hash: 3144942535840632280
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 19:37:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34013
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 101ms
100ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 223
cf-ray: 931e60e15e7e2b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 411 B
336 B 162ms
162ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b35367386570f17ff5be2b4d3f5a9ef2816b7947869005cfae73ec88dcba460

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"038af8099c70ce8099f11e60671651ea"
age: 2497
cf-ray: 931e60e17e992b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.f78d8905f1617efa83f4.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 82ms
81ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aed279b0a29e774ca22dafc6a078e7582490608c9d18bda1a138ca55d0d5be9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f1a6e4325cdcf59d711cbdc9bbf9de8f"
age: 4660
cf-ray: 931e60e28fec2b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.f49d9d120d738f961843.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 461 KB
140 KB 103ms
102ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad7d0d55c693f50a025e443da2f37eaea32dad37cbfe918cde1717f8f33af733

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"2da544a46407e9f6f4d2fc5d5058f814"
age: 4662
cf-ray: 931e60e28fed2b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 559 B
444 B 83ms
82ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 4658
cf-ray: 931e60e3e96f2b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 569F 503 B
427 B 289ms
86ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 4660
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 931e60e54da17d59-LAX
content-encoding: br
content-type: text/html
date: Thu, 17 Apr 2025 19:37:41 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame AEA9 503 B
0 285ms
285ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 4660
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 931e60e54da17d59-LAX
content-encoding: br
content-type: text/html
date: Thu, 17 Apr 2025 19:37:41 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/15/desktop/Chrome/ 585 B
922 B 428ms
127ms XHR
application/json 2600:9000:24f1:b400:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/15/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:b400:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: d71040d52e3fe88d35bc31e4f943102e0d09b27d8eae1ff4cce5587d712d8b24

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 2142
via: 1.1 5d3699e517195152b2b0917312ab80b8.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 585
x-amz-cf-id: k9xk9wspZ8GAZ_kZ8CzRB4KP3StzcxI7Z10sWk51W9SZb56MxGGJ3w==
date: Thu, 17 Apr 2025 19:02:00 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 139 KB
37 KB 228ms
79ms Script
application/javascript 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05b349a7673f4dd1635f02b8f74b18643780bd5cf3e8270aeb88b70ee41fefe5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "a5fef670e18c391b5e759127d35bfadb"
via: 1.1 google
cf-ray: 931e60e51e902a92-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 37305
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: application/javascript
last-modified: Thu, 17 Apr 2025 19:04:19 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.12d39b3042a89bfe935d.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 80ms
79ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/ccpa.12d39b3042a89bfe935d.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 109c88771b4dd248e3dca670efe895b5aaefb0ee49e1cca776b2640717a933ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"206627f4662eb69e99a3cb421866652c"
age: 4660
cf-ray: 931e60e429a92b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:41 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 357 KB
86 KB 425ms
148ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8d079b3855248fcdd0eb891569d2c669c4df9d09e81270f254e37280b51e274a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"8eb33601d7a1e0448ae3ae6845bc11ff"
age: 3456
via: 1.1 2f2d826c16934c22388c7129474b7d96.cloudfront.net (CloudFront), 1.1 84fd743af5e8639c32332cec06beef46.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: XIiDt3avOPRmrTcyqeI9DC8aGgPs-up4w1Q9nFYMSD0gbC7lto06Mw==
date: Thu, 17 Apr 2025 18:40:07 GMT
content-type: application/javascript
last-modified: Tue, 15 Apr 2025 20:04:14 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
584 B 659ms
218ms Image
image/gif 2606:50c0:8000::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8000::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 07079a9a8bf8fecf18923a63d410222b60820252
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 1677:33CC0B:7DE737:907C74:67FC845C
expires: Thu, 17 Apr 2025 19:42:42 GMT
x-cache: HIT
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: image/gif
x-served-by: cache-mad22079-MAD
x-cache-hits: 8
source-age: 242
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1744918662.300989,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
480 B 401ms
128ms Image
image/gif 2600:9000:247b:3c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=ad_300x250_6724608
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:3c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 94238
x-cache: Hit from cloudfront
x-amz-cf-id: 4appPzeI6Md-T80E_nkFFmaqrOSn4lsxG7V-kgpqOkG251ACO9kAtA==
date: Wed, 16 Apr 2025 17:27:04 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 e6b4dbead926e5325f87837a8678a68a.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 413ms
140ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 45322
via: 1.1 74e6dd86eff86d5443ebe1a2ced7df88.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ZPIzu_gh0MPlvuIGCLF1hVrvkiiuw-RWQmy3-KXf6sWREoExmNm_Tg==
date: Thu, 17 Apr 2025 07:02:21 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/ 533 KB
167 KB 139ms
139ms Script
text/javascript 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6ff46bdfa09bd2cc86fd840b1fb83eb60e221dd18197e15d65af6b89dbb86564

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 11726439909185438721
age: 34592
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 10:01:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 10:01:09 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170775
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/ 64 KB
23 KB 147ms
146ms Other
text/plain 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4a1f6bb4df43a4e3aded46465e55b8749b64817d13ed9557075c596d218c340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5790688912801242087
age: 20195
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 14:01:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 14:01:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23384
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504170101"

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 315 KB
110 KB 207ms
206ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3h2v9101576445za200&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a5a7a5d568a60741c0c262b30c0d708287c878d3e980d66d0706497440ff5156

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 19:37:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 112388
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 425ms
146ms Fetch
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54g3h2v9101576445za200&_p=1744918660937&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026&cid=1586790250.1744918662&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744918661&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1723
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80f::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 init-a.js
dl.edge-aicdn.net/assets/ 0
0 233ms
78ms Fetch
text/javascript 2606:4700:20::ac43:4a0f
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://dl.edge-aicdn.net/assets/init-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 806129
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nkg6De8CW2WCkhaMDMd2qQ3MlBJ4ZISZkl48wECNiPqiez7i9zzog4J0%2F03gdpa4NKbDWxzYmYToW78HhAX60%2FWBZGLUdbBSEemL49IBNzYvU%2FBcyUiiGzBlVQ6e%2B4gADn0QdJetqc6l%2B0vVByKb"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 08 Apr 2025 12:41:18 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=64938&min_rtt=64803&rtt_var=13880&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3818&recv_bytes=2235&delivery_rate=59333&cwnd=252&unsent_bytes=0&cid=d1f9f570656a983c&ts=87&x=0"
x-goog-stored-content-length: 0
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:38:53 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItesXpewPkh3PVY937gliQHvMmcijA3GPuaT77G9JBAsbvjNCh5I27xQNwCrR3XBlJF
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 931e60e6ad7808d1-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743183533533707
content-length: 0
server: cloudflare

GET
H2 200 config-a.js
storage.ml-cachehost.net/lib/ 0
0 237ms
81ms Fetch
text/javascript 2606:4700:20::681a:1f4
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://storage.ml-cachehost.net/lib/config-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:1f4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 479779
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=94Bm37T0FfiKolAtoUoNAQh6ItJrGV7zhokyTtEOG4QWLz2hZnvORYYern7JEqcTWVS1QVwrPTiYOkNsSByAobDa%2FAks2u660DLWR4WmOz1IUeVm4yaQ4nZwzvQiltJCXtJkXF8JLQKvcu6kDJqXtKiC6b4d5w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Sat, 12 Apr 2025 06:51:19 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=66166&min_rtt=65971&rtt_var=14166&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3852&recv_bytes=2279&delivery_rate=58159&cwnd=252&unsent_bytes=0&cid=c8e5f349e1c4d880&ts=90&x=0"
x-goog-stored-content-length: 0
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:51:11 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIs4sN3hJIqt_b1oTFGgd_PbZD_XaRCaRDAX0wAr0U_XABLtxFfBYUYmx5pPcSKRqzi_
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 931e60e6af353385-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743184271495855
content-length: 0
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
567 B 230ms
75ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8188
x-goog-stored-content-encoding: identity
expires: Fri, 18 Apr 2025 19:37:42 GMT
x-goog-stored-content-length: 43
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 931e60e6aaeb0f19-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 286ms
132ms Image
image/x-icon 142.250.80.102
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.102 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 56454
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 03:56:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 03:56:48 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 233ms
78ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.6436999357347851
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8188
x-goog-stored-content-encoding: identity
expires: Fri, 18 Apr 2025 19:37:42 GMT
x-goog-stored-content-length: 43
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 931e60e6aaf20f19-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 569F 17 KB
7 KB 89ms
88ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4661
cf-ray: 931e60e5ee797d59-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame AEA9 17 KB
0 81ms
81ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4661
cf-ray: 931e60e5ee797d59-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET c5c12521-301c-4965-bc77-0ece89f4db20
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 384ms
126ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 19:37:42 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 251178
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 169ms
80ms XHR
application/json 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 61450
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744857212&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=zyyVBKOePlfDo2PkpxUyMPq%2FW7ZaqHzgR%2F%2FFm8ghLtQ%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Thu, 17 Apr 2025 02:33:32 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744857212&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=zyyVBKOePlfDo2PkpxUyMPq%2FW7ZaqHzgR%2F%2FFm8ghLtQ%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 931e60e71cf47ede-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
1 KB 87ms
85ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 4661
cf-ray: 931e60e69c4c2b9c-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:08 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 404ms
128ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRbEs4TlpmVGpNRFdDZmtEMjcxaEstMjYxOS0yNjc0NzY2Ny0xMDFhMDI4MC0zNjg0LUcwdWpxNThTZHVHbEQwbEhrVUts/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 481cf5374de4a1279a0cf6311c88150929a485bcdce414880334816749eba84c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 446 KB
141 KB 452ms
174ms Script
text/javascript 2607:f8b0:4006:816::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd157b223b1750cc055c61f89e92980c4bf01073ceca11ae087780f86eb5ff63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16482565349839558474
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 19:37:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144243
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 676ms
219ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-44-209-74-43.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
778 B 409ms
136ms Fetch
application/json 44.195.228.34
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.195.228.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-195-228-34.compute-1.amazonaws.com
Software: /
Resource Hash: 99d353ce25f54713141704f0c8ce28d4f4301d99879fdea45edc282b7675d75b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
683 B 428ms
128ms Fetch
application/javascript 34.232.220.61
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.220.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-220-61.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: a54bbece682a7acdaa6c0c51b3d272c14d997a14c5b786787692533a8cc053bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 242ms
93ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 0916923405a6bdeb4b141686035f708e04e712f7916bf4b5d0534e67608673c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
539 B 409ms
138ms Fetch
text/plain 44.209.74.43
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js2m3jydysjd7rmynratj6j8&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.209.74.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a3d0fff0e37ae24c5570a51ce58b38ad7d8bd721f49d165398f0f022ff676416

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: bc6f64819581f42a
request-time: 9
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 19:37:42 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=G5Bgh3xSVzgvRkp3K1RabFE1Z1ladlpDLzFxZXRONkR3TmxtcjYwbmhlekpQOWRqMUNDTy9JbzJ2dndaYjJUZldXRWxjWXIvTVV5MUJNanQrYVZTRW54UU9Sd1JIZVZOa1RsZkUvb0U3MTdYQTZvNGhvYllGV2NONFVjOW...

357 B
928 B

381ms
128ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=G5Bgh3xSVzgvRkp3K1RabFE1Z1ladlpDLzFxZXRONkR3TmxtcjYwbmhlekpQOWRqMUNDTy9JbzJ2dndaYjJUZldXRWxjWXIvTVV5MUJNanQrYVZTRW54UU9Sd1JIZVZOa1RsZkUvb0U3MTdYQTZvNGhvYllGV2NONFVjOWdNU1lpTmpYZHpMcm50NlRvSVFPdll5UmVrV1FQZkg2RElOeEdRQis4M0w4dlBTY1FSU3MvSFV4VTRBRUlUMlc1Zm5kZjdJeVowS0FEbjFDWVIvWllOSDZ4MnhJbVFwa1hRRFozM2NVUVRoVmNjY1pnSFJBRDd5UHU0R3k1VWVPcERzVGFYREFOfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

9db060dfeae079f56dc2ddd1f87118844c0afe834129bf14ddc5f7c010251131

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 531431
expires: 0
access-control-allow-origin: null
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=G5Bgh3xSVzgvRkp3K1RabFE1Z1ladlpDLzFxZXRONkR3TmxtcjYwbmhlekpQOWRqMUNDTy9JbzJ2dndaYjJUZldXRWxjWXIvTVV5MUJNanQrYVZTRW54UU9Sd1JIZVZOa1RsZkUvb0U3MTdYQTZvNGhvYllGV2NONFVjOWdNU1lpTmpYZHpMcm50NlRvSVFPdll5UmVrV1FQZkg2RElOeEdRQis4M0w4dlBTY1FSU3MvSFV4VTRBRUlUMlc1Zm5kZjdJeVowS0FEbjFDWVIvWllOSDZ4MnhJbVFwa1hRRFozM2NVUVRoVmNjY1pnSFJBRDd5UHU0R3k1VWVPcERzVGFYREFOfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 248996
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 17 Apr 2025 19:37:42 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_7b55cc30-4a52-4eb5-b132-53fa1a0e11d1_1744918662063
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfN2I1NWNjMzAtNGE1Mi00ZWI1LWIxMzItNTNmYTFhMGUxMWQxXzE3NDQ5MTg2NjIwNjMQABoNCIaxhcAGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=0b759d5f755b6c0e0aabdf23bfc1be6573f246c97f8014109ad1e0b9a8ad4673791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=0b759d5f755b6c0e0aabdf23bfc1be6573f246c97f8014109ad1e0b9a8ad4673791426b5417dce21&rand=06329639
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=0b759d5f755b6c0e0aabdf23bfc1be6573f246c97f8014109ad1e0b9a8ad4673791426b5417dce21&rand=06329639&expected_cookie=be4d107c-d4f5-4aa5-8a55-919b8e7a7695

0
143 B

128ms
127ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=0b759d5f755b6c0e0aabdf23bfc1be6573f246c97f8014109ad1e0b9a8ad4673791426b5417dce21&rand=06329639&expected_cookie=be4d107c-d4f5-4aa5-8a55-919b8e7a7695
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: B0F4B123D2EE46EA9415030E105864B0 Ref B: LAX311000110019 Ref C: 2025-04-17T19:37:43Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYy/okVoty6g4SjgtNeCA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 19:37:43 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location: /db_sync?pid=10339&puuid=0b759d5f755b6c0e0aabdf23bfc1be6573f246c97f8014109ad1e0b9a8ad4673791426b5417dce21&rand=06329639&expected_cookie=be4d107c-d4f5-4aa5-8a55-919b8e7a7695
x-msedge-ref: Ref A: 72FF3B9DD92B4DFFBEAF4240CEEBE84C Ref B: LAX311000110019 Ref C: 2025-04-17T19:37:43Z
x-li-fabric: prod-ltx1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYy/okTeajW8xmqyAUxGg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 19:37:42 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_7b55cc30-4a52-4eb5-b132-53fa1a0e11d1_1744918662063
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_7b55cc30-4a52-4eb5-b132-53fa1a0e11d1_1744918662063

1 KB
2 KB

130ms
129ms

Script
application/javascript

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_7b55cc30-4a52-4eb5-b132-53fa1a0e11d1_1744918662063
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: ef0a3cfd02ad3c099a946a6edb46073614b176b1cf62ba4fb23420d270b11d13

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 19:37:43 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_7b55cc30-4a52-4eb5-b132-53fa1a0e11d1_1744918662063
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 19:37:42 GMT

POST
H3 200 2c8d442b00ef386919739429db543975e7c7e7ef7775f8e2a09344a3 Show response
faucetfoot.com/confirm/3139e42564/ 295 B
319 B 183ms
101ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/confirm/3139e42564/2c8d442b00ef386919739429db543975e7c7e7ef7775f8e2a09344a3

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/files/50530363469658c9e05ec319ddb4f65523e19cefff8e789f.v1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

hoothoot/1760148137 /

Resource Hash

7e90bfd85d618d9d7f6cde325526407825858bfd0f9e13cdc149fee436202858

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-spot-jb3g.gce-us-west1, 1.1 google
expires: Thu, 17 Apr 2025 19:37:41 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
446 B 420ms
141ms XHR
application/json 54.159.219.206
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.159.219.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-219-206.compute-1.amazonaws.com
Software: /
Resource Hash: 2056a46fbf2a8e0aac32e099783f387a7db859aa9ee8a78c5a96316c6ba93438

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=utf-8

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 201 KB
65 KB 483ms
191ms Script
application/javascript 2607:f8b0:4006:80c::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d8c23e4181cd7d94c0de3026c37f18d9d1d3c2fdf964d5d74f579de0d63737e5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MdzhYMtFcEyZmXcmzGs9Sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmJw0pBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYhj026ypgJx796brDeO3GQV4uFo29h6gE3gxtm-K0xKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgYmhmZ6BobxBQYAfHAzqA"
content-security-policy: script-src 'report-sample' 'nonce-MdzhYMtFcEyZmXcmzGs9Sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 148ms
147ms Fetch
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54g3h2v9102396898za200zb9101576445&_p=1744918660937&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=1586790250.1744918662&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744918662&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1744918660937&tfd=2138
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3h2v9101576445za200&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80f::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 407ms
144ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 70886
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: O69ciQqEyvXKQp7H5wTH9Rk2o7mZS8JtrefNXi7F1P52s_wj92ZJ5w==
date: Wed, 16 Apr 2025 23:56:17 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 7225c7fb64d09bab64bc17e314ef26a2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 426ms
137ms Script
application/javascript 108.138.106.70
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-70.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1896
via: 1.1 5a8a3f9dea8033ff97627e0a0c6df032.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: gFDHa2Maibe5fLW-matLnqfEdP-A0ytcKdnqZMPUt7QQjdz9Myc2kA==
date: Thu, 17 Apr 2025 19:06:06 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 131ms
131ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 16259
access-control-allow-credentials: true
via: 1.1 84fd743af5e8639c32332cec06beef46.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: zLwGf5FLz8fp0ZJ_ts8fQtBr8_uIHh74r4Ggv7sT0QL-tLMMk7mnPQ==
date: Thu, 17 Apr 2025 15:06:43 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
374 B 782ms
485ms Fetch
application/json 108.139.36.45
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&pid=8j5dKeF1m013c&cb=0&ws=1600x1200&v=25.409.1848&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=605476fd-2184-4887-9ea1-b685483a6ab3&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.36.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-36-45.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 50670fc09f8465be7ae4adcf6e33ab7a.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: TWkiVt6tbtH4AO67G04vfPy1lIrvOPLnvv-a20wlZmcVK61aV5Q_gQ==
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P2
server: Server

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 2B04 2 KB
1 KB 422ms
132ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=55296
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 17 Apr 2025 19:37:42 GMT
expires: Fri, 18 Apr 2025 10:59:18 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 2D20 1 KB
2 KB 232ms
67ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1801
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:07:41 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AKDAyItI8RJQPgXlb_cPXUBopk96LPGaJnzeYHAvCTzLrVty1wUB1064QxEQbqnVaT8NgPmJm3taSjs

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 261ms
161ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8256523c8e8ce45117e1d332f8524472d41a63db95363264674af94944d3e16a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744918662&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=7%2B%2Fxfw0P07A72Nk5XU0lKhqenC7GRY%2BmMoFwR80TTcw%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744918662&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=7%2B%2Fxfw0P07A72Nk5XU0lKhqenC7GRY%2BmMoFwR80TTcw%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 931e60e97c0c69d1-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 423 B
1 KB 498ms
399ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0323d62047e026c222c13a50ecb4d94a8928b7a15217a1f643d44db07de00e8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744918662&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=7%2B%2Fxfw0P07A72Nk5XU0lKhqenC7GRY%2BmMoFwR80TTcw%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744918662&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=7%2B%2Fxfw0P07A72Nk5XU0lKhqenC7GRY%2BmMoFwR80TTcw%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 931e60e97c0f69d1-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 417ms
130ms Fetch
application/json 52.54.61.153
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744918662433&to=600&aun=pw-160x600_atf&pubcid=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33acrossId=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=4bb3bfc2-5b39-4190-b801-ea51da932066&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.61.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-61-153.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 416ms
130ms Fetch
application/json 52.54.61.153
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744918662434&to=600&aun=pw-160x600_btf&pubcid=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33acrossId=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=6850b69a-0fbc-4369-a3c2-929e57f7ffd7&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.61.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-61-153.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 417ms
132ms Fetch
application/json 52.54.61.153
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744918662434&to=600&aun=leaderboard_atf&pubcid=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33acrossId=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=6c1e1f07-8476-4fa1-94c1-c0069332df8f&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.61.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-61-153.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 418ms
132ms Fetch
application/json 52.54.61.153
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744918662434&to=600&aun=leaderboard_btf&pubcid=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33acrossId=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=f8805b5e-f415-4887-ab5d-87e347624b1e&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.61.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-61-153.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
627 B 1251ms
141ms Fetch
application/json 3.168.102.72
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-72.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: f2bafea0b936555073ba153236aa6bc9d1a7c7e12c153f3336cd361ed960e5d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 9d9b3f05e994245e3be7cd3dbae1ce50.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: wDwlVcdtWaxBGqscQzuKfl2DOIpaAYtBkIA8SMS_JNBRuUyBwU_KvQ==
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 469 B
1 KB 405ms
131ms Fetch
application/json 68.67.160.26
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.26 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

efb10e050a95ee1b76a3dc579b20ab7cf40ff4c3526b6a051fb1bb8b45b6e780

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.245; 162.245.206.245; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: ee3eb88e-9033-4748-9fe2-c256f56cf502
content-length: 469
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 19:37:42 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 694 B
1 KB 528ms
238ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=dde5a085-fedc-4de8-8216-7ec806349da1&l_pb_bid_id=782d578c02d6329&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=4bb3bfc2-5b39-4190-b801-ea51da932066&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.3638530096949113
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 8713685e4a58c46ea625a7cc38ca3eca269f81c31e4e18e5707176199d62ce8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 526 B
876 B 508ms
219ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=dde5a085-fedc-4de8-8216-7ec806349da1&l_pb_bid_id=79bb37cdfa5cac18&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=6850b69a-0fbc-4369-a3c2-929e57f7ffd7&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.7014861634673164
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 46b4100bd81af295edd3f3e74445eae83d5a25e97c248400fad054a3cf0dc458

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 526
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
882 B 424ms
135ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=dde5a085-fedc-4de8-8216-7ec806349da1&l_pb_bid_id=8051c8458f509ed&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=6c1e1f07-8476-4fa1-94c1-c0069332df8f&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.872524880768406
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 090f9af2b6131ce0f7f2e088c73fa05627cc882c79fb9e4e78762b7925539faa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
1 KB 419ms
130ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.7%2BhAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt%2FBC5rHvsL%2B%2F4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou%2FRODV4y0dVyuQXG4bGTNO5q0e0W%2FqRBKwbv5ueEw%2BefX5Lfa9r2nsphTizIcd%2FUbI37nWMb2OIz%2FwJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1%2Fzurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw%2FL65Xw1KjBb0cIoFIwrWZ882c1%2FBjq3%2FbZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl%2FdVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ%2BhqyH1tMSoMXnBhV%2FS9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9%2B0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo%2BYZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf%2FrFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh%2BIwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9%2FLHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb%2Bil7UicLNB3a103DFFc3ZH8NTHIq1faY%2BCsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x%2FJCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3%2FZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs%2FPIUuVzO%2F4T0s6A%2BvPOgyr9VPOlcjKxDRmR%2FpAYJo6P6svwssd43p8rrSz%2FDp1qC3whbzSueANwyHCjG4d%2Bu2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS%2By6FnUCnEVCCuYfshzU%2F%2FRYDwSbwHw%2BIGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9%2B%2BG5phJb%2FlCz6HN6UlzMgeakibX%2BwDoQKksrwZmJ0yEcHFLXkFQWaXKm5F%2F0ppt%2BhR8rvyvMqD%2Fc%2BL5AUoc1bX1h6918%2B1Jh5%2BBtp%2BUq3lUB3JW8%2F3JNnYV52a4NGitd0OskzzDF%2FKNrH2XCoH6%2B8TELmACAxT7Ug%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=dde5a085-fedc-4de8-8216-7ec806349da1&l_pb_bid_id=815f8f6b6ae12ce8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=f8805b5e-f415-4887-ab5d-87e347624b1e&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.786400872095254
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 4d50038c1ae2d87c6e43db77c66ae1b3bfc3de407456358a4982cf004d04b89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 1103ms
299ms Fetch
application/json 3.226.121.246
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.226.121.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-226-121-246.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 238ms
96ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: b4b8d715fcbc60a02d11ef048a4abb1cc96485295fe8866dabbffaff35afdccc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.245
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/plain
vary: Origin

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 34 B
320 B 438ms
144ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fb90cbdf09f3b22e16fcfd558b1329b8f9edfc929479add124184b1d3f22011f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 19:37:42 GMT
server: nginx

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 1265ms
226ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

33953ee173b389b92aa0b294adad6d577648ed8fcc26e71145d4da93ed679de6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 595ms
308ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 19:37:43 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 682ms
395ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 19:37:43 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 586ms
296ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 19:37:43 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 849ms
261ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 19:37:43 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 39 B
660 B 242ms
95ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 143f8f111f94703ef880b005679283e243cac26b3ee3f683f3e176637c33453d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lqoXAm3VrepFTOcQwrCNuxLuLArFDrXuXj4zVbtrQTlpwJSA0dt30BwWET9O4YRe8ZRpRLlsouAPlgDtMbrWzCWHWtkPmabOXv7xbHHlj1mVn3xxLmmtd1FGm8cvi3CCg6eQNdnr"}],"group":"cf-nel","max_age":604800}
cf-ray: 931e60e9ecba2efc-LAX
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 39
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 553ms
252ms Fetch 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 435ms
136ms Fetch 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 550ms
251ms Fetch 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 554ms
254ms Fetch 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 434ms
133ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 144 B
991 B 324ms
171ms Fetch
application/json 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5adf95c3c0976efa57cb45347b778e4a8502ba8fe49f3d69f5d7fe8dce3183e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 931e60ea0902f207-LAX
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 391ms
123ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=87638817095&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:42 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 428ms
131ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRbEs4TlpmVGpNRFdDZmtEMjcxaEstMjYxOS0yNjc0NzY2Ny0xMDFhMDI4MC0zNjg0LUcwdWpxNThTZHVHbEQwbEhrVUts/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 17 Apr 2025 19:52:42 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 17 Apr 2025 19:37:42 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 150ms
147ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRbEs4TlpmVGpNRFdDZmtEMjcxaEstMjYxOS0yNjc0NzY2Ny0xMDFhMDI4MC0zNjg0LUcwdWpxNThTZHVHbEQwbEhrVUts/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 43465
via: 1.1 74e6dd86eff86d5443ebe1a2ced7df88.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ju_fxQ4edXBhcTg6v4u6fC74XoOTQI0J0SOgiO-eX-BxNLdUsBdrFQ==
date: Thu, 17 Apr 2025 07:33:18 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 272ms
119ms Script
text/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRbEs4TlpmVGpNRFdDZmtEMjcxaEstMjYxOS0yNjc0NzY2Ny0xMDFhMDI4MC0zNjg0LUcwdWpxNThTZHVHbEQwbEhrVUts/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3032
cf-ray: 931e60ea2d2cd7af-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Tue, 22 Apr 2025 19:37:42 GMT
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 238ms
87ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50e007518d200ae11214757387229dbd045c72df7a6180821e460442a605565a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"5ad11df110aef21f5b862d37fdc34379"
age: 10
expires: Thu, 17 Apr 2025 20:37:42 GMT
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 02 Apr 2025 08:25:26 GMT
vary: Accept-Encoding
x-amz-id-2: d5gHHgaZRPqTvlmcFB5C/xZHMn01peIqC5aUQzaL0PtZb2X3kYunxjRAKAOYZVFclXnmA/yKocIlKwyw9nfL9Eyck5HuVYAT
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: R8S04N5C7A9H0AB6
cf-ray: 931e60ea2d83cb86-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 557ms
262ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRbEs4TlpmVGpNRFdDZmtEMjcxaEstMjYxOS0yNjc0NzY2Ny0xMDFhMDI4MC0zNjg0LUcwdWpxNThTZHVHbEQwbEhrVUts/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 17 Apr 2025 19:52:42 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 17 Apr 2025 19:37:42 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1744918662596&did=did-0046&se=e30&duid=8e413bd09c43--01js2m3jydysjd7rmynratj6j8&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgr...
https://rp4.liadm.com/j?dtstmp=1744918662596&did=did-0046&se=e30&duid=8e413bd09c43--01js2m3jydysjd7rmynratj6j8&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcg...

13 B
371 B

398ms
128ms

Fetch
application/json

54.235.156.217
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1744918662596&did=did-0046&se=e30&duid=8e413bd09c43--01js2m3jydysjd7rmynratj6j8&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 54.235.156.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-156-217.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 1c2375b2-6f41-443d-b858-3ee32c963525
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1744918662596&did=did-0046&se=e30&duid=8e413bd09c43--01js2m3jydysjd7rmynratj6j8&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo2
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 17 Apr 2025 19:37:43 GMT

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 413ms
127ms XHR
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 414ms
129ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
97 B 399ms
125ms XHR
application/octet-stream 100.27.136.39
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.27.136.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-27-136-39.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame FD1D 0
101 B 406ms
127ms Document
text/plain 52.54.61.153
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.61.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-61-153.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Thu, 17 Apr 2025 19:37:43 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 695ms
227ms Fetch
application/json 162.19.138.119
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

847cd711a7c6c8c96c3e1377c8137219238332a9b815bc032b1418d230c280d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 398ms
124ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 19:37:42 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 166501
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 AGSKWxXoJRtsWj9o-4p0CXggS1qJ6SAC90j8gqdSCTVQZ4j1mrZ7-hHA0SR73kdJ8TBlfZ3Sa1De-QkyDeLL4_1Usfdt48EF_ULEkj7657fx0nFlbKqqbN67C-qqzKgb8RZleBA9zBhbqg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 183ms
182ms Script
application/javascript 2607:f8b0:4006:80c::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXoJRtsWj9o-4p0CXggS1qJ6SAC90j8gqdSCTVQZ4j1mrZ7-hHA0SR73kdJ8TBlfZ3Sa1De-QkyDeLL4_1Usfdt48EF_ULEkj7657fx0nFlbKqqbN67C-qqzKgb8RZleBA9zBhbqg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTE4NjYzLDU2MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsInpaR1NGeGhDLXpJIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInF3eHouZG1jZ3JhdGhidWlsZGluZy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6b7e97f9a5e17684ecf69b440b9555c13a7806c5ae76aac76cdfe80781efab5c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-oatYrrAQe0DhgClFCi9wMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmII1pBiOHnrNtNFIG69eY51KhAbrT3P6gTEhgqXWB2B-P66S6zPgfhD_WXWH0BcJHGFtQmIY9NusqYCce_em6w3jtxkFeLmaN_YeoBN4MSbr4VKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgYmhmZ6BobxBQYA4E842g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-oatYrrAQe0DhgClFCi9wMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame F091 101 KB
28 KB 394ms
131ms Document
text/html 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af8c669f941e754271c71ba5714ac0e5247ce6c3d1b1638257e1b2862d33beaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1643
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28941
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:10:20 GMT
expires: Thu, 17 Apr 2025 20:00:20 GMT
last-modified: Mon, 14 Apr 2025 19:44:10 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 432ms
135ms Script
application/javascript 2600:9000:24f1:7600:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:7600:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 2055
x-cache: Hit from cloudfront
x-amz-cf-id: KQ4Jgr4mqY3gjW4oGe8TwNhDBlEvaRakhdL86Bv2nGktjoPBgjMWSQ==
date: Thu, 17 Apr 2025 19:03:29 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 820b14719bf91dbc846cab9728bc3fe6.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 215ms
67ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 187549
x-goog-stored-content-encoding: gzip
expires: Wed, 15 Apr 2026 15:31:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 15 Apr 2025 15:31:54 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyItIUbTZ9gJzw53fy34N30mENeJLMNCCyMCkzVlwDjNzWvvg2EyjGztrDlmBBHR9QwwJ
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 388ms
240ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 859687014a4c6a9de9fc1c7c17b78ecb

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 237ms
76ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 435107
cf-ray: 931e60edd846f0e1-LAX
expires: Sun, 20 Apr 2025 19:37:43 GMT
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 507ms
249ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 18 Apr 2025 19:37:43 GMT
access-control-allow-origin: *
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=34d8d62b-50a2-4662-8b5c-c177644e25fd&bid=1e2n4ou

70 B
440 B

214ms
129ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=34d8d62b-50a2-4662-8b5c-c177644e25fd&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 19:37:43 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=34d8d62b-50a2-4662-8b5c-c177644e25fd&bid=1e2n4ou
content-length: 191
date: Thu, 17 Apr 2025 19:37:43 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MnZEM3EzendFRVVXQ0ZlN3RNeWU3RmQ3bjU5anBGdHBVcXMydV9CeXJQRFU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MnZEM3EzendFRVVXQ0ZlN3RNeWU3RmQ3bjU5anBGdHBVcXMydV9CeXJQRFU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

172ms
130ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 19:37:43 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Thu, 17 Apr 2025 19:37:43 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-XJaRDKZE2pVpQEmH0EH.uNMTOwlO3Dzsc84-~A&gdpr=0

70 B
440 B

165ms
132ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-XJaRDKZE2pVpQEmH0EH.uNMTOwlO3Dzsc84-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 19:37:43 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-XJaRDKZE2pVpQEmH0EH.uNMTOwlO3Dzsc84-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2537431581129411963&newuser=1&referrer_pid=m51mh00

70 B
440 B

168ms
129ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2537431581129411963&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 19:37:43 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2537431581129411963&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 19:37:39 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=5582797162784420863&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

129ms
129ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5582797162784420863&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 19:37:43 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=5582797162784420863&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.245; 162.245.206.245; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: f5b9a6af-77d6-44af-a7e3-bda36586fe89
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 19:37:43 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 134ms
134ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 17 Apr 2025 19:52:43 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 17 Apr 2025 19:37:43 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame E609 0
413 B 417ms
129ms Document
text/html 54.173.207.78
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.173.207.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-173-207-78.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Thu, 17 Apr 2025 19:37:43 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H2 200 AGSKWxU2zT4zygb5yjxBG3e-8z437OfkETcZezWAU3ewbbx3EAxBJ7ciJxMIvRDqKJ7Q_1D-uSolNUmwvCZ8NUyGAam-nZqMSQaKUNtFfWYrHrRnvFAFG0OB-78UxYYjaaimcOHSro3mFQ== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 193ms
192ms Script
application/javascript 2607:f8b0:4006:80c::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxU2zT4zygb5yjxBG3e-8z437OfkETcZezWAU3ewbbx3EAxBJ7ciJxMIvRDqKJ7Q_1D-uSolNUmwvCZ8NUyGAam-nZqMSQaKUNtFfWYrHrRnvFAFG0OB-78UxYYjaaimcOHSro3mFQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTE4NjYzLDI0NzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwielpHU0Z4aEMtekkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXd4ei5kbWNncmF0aGJ1aWxkaW5nLmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6307d2eb6de97e82a68d465fcaa206198d783f0365558cdfac8469ae8553773c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lMq36_iuQGnVi85p01P4Lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmJw05BiOHnrNtNFIG69eY51KhAbrT3P6gTEhgqXWB2B-P66S6zPgfhD_WXWH0BcJHGFtQmIY9NusqYCce_em6w3jtxkFeLhaN_YeoBNYELP9AuMShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRqYGJoZmegaG8QUGAOjLODg"
content-security-policy: script-src 'report-sample' 'nonce-lMq36_iuQGnVi85p01P4Lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 243ms
84ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6192d7b9a03dc98c0490251dfd8f4f7b767bfb4c2726977fc3019a6635bdf342

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 129
cross-origin-resource-policy: cross-origin
cf-ray: 931e60eefea808c9-LAX
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 17 Apr 2025 19:32:47 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
279 B 86ms
85ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68b56e1adb38025f5fe28cc77eb5d91cc7543539c1c5e3921ee25375e73bd28c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 931e60ef8b2609cf-LAX
access-control-allow-origin: *
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 247ms
86ms Preflight
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 931e60eef94709cf-LAX
content-length: 0
content-type: text/plain
date: Thu, 17 Apr 2025 19:37:43 GMT
expires: Fri, 17 Apr 2026 19:37:43 GMT
server: cloudflare

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
460 B 431ms
136ms XHR
application/json 2606:ae80:1451:18::1780
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1451:18::1780 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 17 Apr 2025 20:07:43 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
vary: Origin
server: nginx

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
550 B 372ms
224ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: ef2cc7a68d8700fdfb62e073e9661111ffe697ac988ee4b584956b9c35c1f9de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 285
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
x-cloud-trace-context: 7e10bedab5440c828da6df50a318caec
server: Google Frontend
access-control-allow-headers: X-Requested-With

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 222ms
220ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

21cf532ead9eaa43d82b56df62ebdb3eee6796b48f10b4f1387d9cd411b8b24d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
vary: Origin

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 222ms
221ms Fetch
text/plain 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 227ms
225ms Fetch
application/json 162.19.138.119
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

847cd711a7c6c8c96c3e1377c8137219238332a9b815bc032b1418d230c280d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 3E39
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

269 B
380 B

417ms
132ms

Document
text/html

23.217.173.107
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.217.173.107 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-217-173-107.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 17 Apr 2025 19:37:44 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 19:37:43 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
server: AkamaiGHost

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 247ms
82ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e3f84b2a779d78921849c67d98e91ee507be4fe504fc609bb4293bce0e5910e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 300
cf-ray: 931e60f18c89135e-LAX
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 17 Apr 2025 19:23:52 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
171 B 280ms
115ms Image
image/gif 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&halo_id=060ixedju6a65cehcjl6gelekjl9ef8ehdfuomkwi0e0yimsiw00qm0myw06mo4ms
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f189052eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
246 B 304ms
98ms Image
text/html 52.88.33.114
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.88.33.114 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-88-33-114.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&adnxs_id=5582797162784420863&gdpr=0

43 B
95 B

113ms
113ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&adnxs_id=5582797162784420863&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f2fa9a2eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&adnxs_id=5582797162784420863&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.245; 162.245.206.245; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 9f5a250a-44ea-47a4-9692-e7137077281a
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001744918664-X7OS3AKN-MPKX%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001744918664-X7OS3AKN-MPKX%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=4956af8f-f72c-4caf-8f75-8e2fe0486756&id=AU1D-0100-001744918664-X7OS3AKN-MPKX&auid=AU1D-0100-001744918664-X7OS3AKN-MPKX

43 B
119 B

113ms
113ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=4956af8f-f72c-4caf-8f75-8e2fe0486756&id=AU1D-0100-001744918664-X7OS3AKN-MPKX&auid=AU1D-0100-001744918664-X7OS3AKN-MPKX
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f29a352eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=4956af8f-f72c-4caf-8f75-8e2fe0486756&id=AU1D-0100-001744918664-X7OS3AKN-MPKX&auid=AU1D-0100-001744918664-X7OS3AKN-MPKX
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001744918664-X7OS3AKN-MPKX
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001744918664-X7OS3AKN-MPKX
https://ids.ad.gt/api/v1/pbm_match?pbm=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&id=AU1D-0100-001744918664-X7OS3AKN-MPKX

43 B
95 B

119ms
118ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&id=AU1D-0100-001744918664-X7OS3AKN-MPKX
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f3ab372eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&id=AU1D-0100-001744918664-X7OS3AKN-MPKX
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 19:37:43 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001744918664-X7OS3AKN-MPKX&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&rub=M9LRIP5I-22-5F5M&gdpr=0

43 B
95 B

112ms
112ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&rub=M9LRIP5I-22-5F5M&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f2fa972eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&rub=M9LRIP5I-22-5F5M&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: cdd55fb02049ca8b9389527f6c1a1194
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001744918664-X7OS3AKN-MPKX&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd&id=AU1D-0100-001744918664-X7OS3AKN-MPKX

43 B
94 B

176ms
119ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd&id=AU1D-0100-001744918664-X7OS3AKN-MPKX
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f1890a2eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd&id=AU1D-0100-001744918664-X7OS3AKN-MPKX
content-length: 259
date: Thu, 17 Apr 2025 19:37:43 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001744918664-X7OS3AKN-MPKX&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001744918664...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001744918664-X7OS3AKN-MPKX&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001744...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=83d8ef4f-098f-4ac0-a494-77a92a714220%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=34d8d62b-50a2-4662-8b5c-c177644e25fd&ttd_puid=83d8ef4f-098f-4ac0-a494-77a92a714220%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&tapad_id=83d8ef4f-098f-4ac0-a494-77a92a714220

43 B
95 B

119ms
119ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&tapad_id=83d8ef4f-098f-4ac0-a494-77a92a714220
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f50cad2eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&tapad_id=83d8ef4f-098f-4ac0-a494-77a92a714220
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 17 Apr 2025 19:37:44 GMT
server: Jetty(11.0.25)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
244 B 152ms
150ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001744918664-X7OS3AKN-MPKX

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:43 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001744918664-X7OS3AKN-MPKX
https://ids.ad.gt/api/v1/amo_match?turn_id=4334320726214499808&id=AU1D-0100-001744918664-X7OS3AKN-MPKX

43 B
95 B

149ms
120ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=4334320726214499808&id=AU1D-0100-001744918664-X7OS3AKN-MPKX
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f189082eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=4334320726214499808&id=AU1D-0100-001744918664-X7OS3AKN-MPKX
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 19:37:55 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&uid=efdc75c7-1225-40b2-97f9-5bce566d1e88&gdpr=0

43 B
95 B

114ms
113ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&uid=efdc75c7-1225-40b2-97f9-5bce566d1e88&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f3fb902eb7-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744918664-X7OS3AKN-MPKX&uid=efdc75c7-1225-40b2-97f9-5bce566d1e88&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 17 Apr 2025 19:37:44 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-146
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001744918664-X7OS3AKN-MPKX
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDkxODY2NC1YN09TM0FLTi1NUEtY

170 B
188 B

148ms
147ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDkxODY2NC1YN09TM0FLTi1NUEtY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 931e60f1a92e2eb7-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDkxODY2NC1YN09TM0FLTi1NUEtY
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 163ms
163ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 17 Apr 2025 19:52:43 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 17 Apr 2025 19:37:43 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
10 KB 450ms
450ms Fetch
text/plain 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2710421478754504&correlator=3385786944302583&eid=31086814%2C31091816%2C95355263%2C83321073&output=ldjh&gdfp_req=1&vrg=202504160101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1744918663740&lmt=1744918663&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1KkxzOUJQU2ctOUZVcFdjTWVaVjBfcldsUVlsQldjVWxSanpZRzJvSE9UVElQUVYtYzhpVVhGZjRHWHJtTXg2RzdYARI0CgpwdWJjaWQub3JnEiQ0ZTE3MWQ5NS1kYTJkLTRjZWQtOGFiNC0xZDBlNTllNGVmNTJYARIdCg5lc3AuY3JpdGVvLmNvbRiXn4eq5DJIAFICCGQSGAoJeWFob28uY29tGM6ih6rkMkgAUgIIbxIXCghydGJob3VzZRiXn4eq5DJIAFICCGQSFAoFb3BlbngY-6CHquQySABSAghvEhsKDDMzYWNyb3NzLmNvbRiXn4eq5DJIAFICCGQShwEKDmxpdmVpbnRlbnQuY29tEnMxMy1QRURNNld2V3VxWVpvTjJiejVSb0Y2amhqUlczRU1Vb0RNWS8zcUhFSW9ML0V3STM1YXZUVFhzRFgwMU1EMnYxTGVtMzZsMDV5ZmNFbWc0QUp1SndsbHJiRzRqZGRDaGlsa2M4dHlqUG9rcUEydz09WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1744918660921&idt=1296&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Dcb56527758ba4d2b86bf58e1823f070018662327%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D469762048%252C218890240%26cc-iab-class-id%3D482%252C283%26cc-iab-name%3DShopping.Children%27s%2520Games%2520and%2520Toys%252CHome%2520%2526%2520Garden.Interior%2520Decorating%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.dmcgrathbuilding.com%252F%26tyche_code%3DV.20250415.1%26pageos_code%3DV.20250415.1%26config_id%3D1024872_74068_primary_config%26hour%3D9%26day%3DThursday%26referrer_domain%3Dqwxz.dmcgrathbuilding.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250415.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=40956&tan=a368fa44-ff8d-44fb-a5c6-25308d66c978&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20857657a68945e93d90c49d72cb9e9cb1e930f5ea6e3633e0be2b099b1d8d8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 10091
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame F6C3 7 KB
3 KB 434ms
145ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:44 GMT
expires: Thu, 17 Apr 2025 19:37:44 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 224ms
222ms XHR
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-3-208-229-142.compute-1.amazonaws.com

Software

Resource Hash

8b8bb67b6aeebbc1ee2323b655a4bad2713be4ed08e4922c940d57d3cba45d7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json
vary: Origin

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
112 KB 165ms
165ms Script
application/javascript 142.251.35.168
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

b340405cee8efe32413394d26946ecd7c537fc0b53085cff59fcac4587cfdb2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 19:37:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 114460
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
113 B 159ms
157ms XHR
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f21ada08c9-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
89 B 371ms
144ms Script
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f398782c69-SLC
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:44 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 189 B
222 B 117ms
114ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 949dbe9d3aac1167327f4fb8643e0dd1f6e4778aec6f02db8da2281b96a42877

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 931e60f439c37ee9-LAX
access-control-allow-origin: *
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 341ms
175ms Preflight 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 931e60f328c77ee9-LAX
date: Thu, 17 Apr 2025 19:37:44 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

GET
H/1.1

200
OK

id5
match.prod.bidr.io/cookie-sync/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*gfcDg4cGtuuGYYGgymV9E8ZoIO75SQvvIA5EZC72D4wPQQNm5i4E7AmfT2mF5rlQ&gdpr_consent=undefined&gdpr=false
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=

43 B
433 B

541ms
140ms

Image
image/gif

3.208.229.142
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/id5?us_privacy=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

3.208.229.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: no-cache, must-revalidate
pragma: no-cache
Connection: keep-alive
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length: 43
Date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
Server: gunicorn

Redirect headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
location: https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 19:37:44 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3 200 google_caf.js Show response
fundingchoicesmessages.google.com/f/AGSKWxXhmQFE-WKVVfli1cSBHdMn-AXLRZVWsIH8wJKs46wYgBadVz8O8vYZTH1ERLbSQl3NG2UQ8HtC20G6icM9L3Gs2DYkpbPIeQu_u6n7QHXnu0aOJZOs0f9YG5J9o-t-V2V1XPu4nKrD0sRySy_rRwzd0WkME... 54 B
109 B 159ms
158ms Script
application/javascript 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXhmQFE-WKVVfli1cSBHdMn-AXLRZVWsIH8wJKs46wYgBadVz8O8vYZTH1ERLbSQl3NG2UQ8HtC20G6icM9L3Gs2DYkpbPIeQu_u6n7QHXnu0aOJZOs0f9YG5J9o-t-V2V1XPu4nKrD0sRySy_rRwzd0WkME9NTuqAg316CG6I2lxBNrJTfqlV30GqR/_/system_ad.://a.ads./google_caf.js?:-abp-properties(image/)-adsscript.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4c8111c8b0eb7500a805151f947c9c71c1737963df8b8b9469fb7684993a668b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-GcV1soPcNYa5EmyBigmtJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmJw0ZBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4ubo2Nh6gE1gQ9OSfCWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxNDMz0Dw_gCAwA5eDLv"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-GcV1soPcNYa5EmyBigmtJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
67 B 412ms
138ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 13036835877489095579
age: 14335
x-content-type-options: nosniff
expires: Thu, 01 May 2025 15:38:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:38:49 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 42
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxU2Yrj3OOySxbuYMYOKP4RYSxu3RGRyN-l-42YCTDjjsUjj43EyGhba1LbWNXHzPjn8zy41cFh5wClRUAFsCTcza3Q7vQ7LFSsyHiaWRQt-2Ky_waLvFLMTlboFWemI8m7Yhnc0YQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 296ms
156ms XHR
text/html 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU2Yrj3OOySxbuYMYOKP4RYSxu3RGRyN-l-42YCTDjjsUjj43EyGhba1LbWNXHzPjn8zy41cFh5wClRUAFsCTcza3Q7vQ7LFSsyHiaWRQt-2Ky_waLvFLMTlboFWemI8m7Yhnc0YQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ymcpRoEQVLQ3JI6hklqQ2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtHikmLw1pBiWMS_i-lD_WXWH0AsxMPRsbH1AJvAhxWPNzAquSTlF8Yn5-eVpOaV6CamFOuC2EWZSaUl-UUo7NQykIqc_PT0zLz0eCMDI1MDE0MzPQOz-AIDAPZWJgM"
content-security-policy: script-src 'report-sample' 'nonce-ymcpRoEQVLQ3JI6hklqQ2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 container.html Show response
1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 18E5 7 KB
0 0ms
0ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:44 GMT
expires: Thu, 17 Apr 2025 19:37:44 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 2374 803 B
1 KB 241ms
91ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 97b965f48af5880c50b039bbfcdbd294d4be0683aead07f6e76aa9634a429e02

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Thu, 17 Apr 2025 19:37:44 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.245

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 7F35 52 KB
17 KB 664ms
216ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 24574
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 17 Apr 2025 19:37:44 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1503917, 60815
X-Served-By: cache-lga21993-LGA, cache-mad22063-MAD
X-Timer: S1744918665.873378,VS0,VE0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 96A8 2 KB
1 KB 375ms
124ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:44 GMT
server: Kestrel
server-processing-duration-in-ticks: 67856
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame 92B5 11 KB
5 KB 241ms
107ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33across.com=v1.0014000001YrMoYAAV.1040.7+hAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt/BC5rHvsL+/4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou/RODV4y0dVyuQXG4bGTNO5q0e0W/qRBKwbv5ueEw+efX5Lfa9r2nsphTizIcd/UbI37nWMb2OIz/wJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1/zurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw/L65Xw1KjBb0cIoFIwrWZ882c1/Bjq3/bZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl/dVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ+hqyH1tMSoMXnBhV/S9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9+0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo+YZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf/rFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh+IwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9/LHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb+il7UicLNB3a103DFFc3ZH8NTHIq1faY+CsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x/JCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3/ZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs/PIUuVzO/4T0s6A+vPOgyr9VPOlcjKxDRmR/pAYJo6P6svwssd43p8rrSz/Dp1qC3whbzSueANwyHCjG4d+u2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS+y6FnUCnEVCCuYfshzU//RYDwSbwHw+IGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9++G5phJb/lCz6HN6UlzMgeakibX+wDoQKksrwZmJ0yEcHFLXkFQWaXKm5F/0ppt+hR8rvyvMqD/c+L5AUoc1bX1h6918+1Jh5+Btp+Uq3lUB3JW8/3JNnYV52a4NGitd0OskzzDF/KNrH2XCoH6+8TELmACAxT7Ug&linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744918662798&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ded95c1d26dafdb7a0c8e783602ea55d1f9ba2d35ceed160aae2d059b8df712

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 931e60f508c47d65-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:44 GMT
expires: 0
last-modified: Wed, 16 Apr 2025 11:15:45 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 830A 0
0 403ms
127ms Document
text/plain 198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 17 Apr 2025 19:37:44 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame A565 20 KB
7 KB 133ms
131ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=161972
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 19:37:44 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 4DEF 269 B
380 B 152ms
131ms Document
text/html 23.217.173.107
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.217.173.107 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-217-173-107.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 17 Apr 2025 19:37:44 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame E4C4 3 KB
2 KB 217ms
75ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 180
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 931e60f52868490e-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 17 Apr 2025 19:37:44 GMT
expires: Thu, 17 Apr 2025 23:37:44 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame E05C 1 KB
2 KB 407ms
135ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 214fab2f207d87789eb5d0b1735d886013ebdb7d627d73006fbe1f2f42541a52

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1093
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:44 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 130ms
126ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=tf4Awl9CR2RCWUhNeEk1bk9GSk1UYnEyT3d6bUw2cU5QZmNXZWx2VlVrOTM0Um4xcmExUFlDWUh3RmY4Vng5aCUyRmtPV1BicCUyRlRIdld6dkdyVTZGYXg1Z3JOT3NVVUZMVzE1cWlHSW53ZTlOclhmTnFkUThlTHhVdzNUdlNROW9qbDIzRzU&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 19:37:44 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 295871
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 222ms
220ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:43 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
662 B 131ms
126ms Fetch
application/javascript 34.232.220.61
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.220.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-220-61.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 6b3ac7ad128ff186b4af533829d3a11b87187ea8a94162b75ad848134521c397

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 95ms
91ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&us_privacy=1NNY&tp=EIJKtDTgK5zR0Rh35HPRFb8%2BPaNa49Z9%2BzFhFH%2BZRf4%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 0916923405a6bdeb4b141686035f708e04e712f7916bf4b5d0534e67608673c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
0 3ms
3ms Fetch
text/plain 44.209.74.43
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js2m3jydysjd7rmynratj6j8&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.209.74.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-209-74-43.compute-1.amazonaws.com
Software: /
Resource Hash: a3d0fff0e37ae24c5570a51ce58b38ad7d8bd721f49d165398f0f022ff676416

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: bc6f64819581f42a
request-time: 9
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 19:37:42 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Thu, 17 Apr 2025 19:37:42 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 125ms
124ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 288883
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

rubicon
match.adsrvr.org/track/cmf/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5582797162784420863&ttd_tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

70 B
501 B

96ms
94ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 70
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
server: Kestrel

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
content-length: 0
Content-Type: text/html

GET
H2 200 sync
x.bidswitch.net/ 43 B
184 B 424ms
139ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU2Yrj3OOySxbuYMYOKP4RYSxu3RGRyN-l-42YCTDjjsUjj43EyGhba1LbWNXHzPjn8zy41cFh5wClRUAFsCTcza3Q7vQ7LFSsyHiaWRQt-2Ky_waLvFLMTlboFWemI8m7Yhnc0YQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-hWtEF3yQ2iM5vSiMw1A07A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII1pBi-FB_mfUHEAvxcHRsbD3AJvDg-JpLjEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAAaqoklA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-hWtEF3yQ2iM5vSiMw1A07A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D5BC 645 B
254 B 428ms
156ms Document
text/html 142.250.65.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGKbN-LUCMAE&v=APEucNWywVvPf-z-d-5igvd2aDIuCS6b6DIfaLSRQyoLm3dImYOuAbNLqwz2QTPGFnmsf174e5zPZdTv-UBaOKIi6ZBsjzt_mFLoWErydK-AxBxHnxpM6_M

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f2.1e100.net

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 18E5 110 KB
37 KB 501ms
234ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18146946010209014275
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 19:37:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38116
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18E5 42 B
63 B 676ms
410ms Image
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BcI7VOHZgNyDLRSYnLviI7qBuzp2Vq1kNQyvUhB2BGPEUfx1V7Z5_6iDQgiryNX9xjWISobT-TMmjdhDb30CNPDm9Kl4UQJHFpC4d_ZbNeqeNvGzU

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 apis_1_1.min.js Show response
cdn.clinch.co/a_js/api/ Frame 18E5 2 KB
1 KB 452ms
130ms Script
application/javascript 2600:9000:261f:4200:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.clinch.co/a_js/api/apis_1_1.min.js

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:261f:4200:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

604302d943ca6c7fa6166d82d35c230856151cbbed622293e2b20d34c6cfd8ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: W/"f13651a5834c3412c3a233f57e722944"
age: 2539750
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 3ntCofn72MRRP4g7hGaNF6bG8ZZL8RSf-shxCZ1ZgulynS68QP-kQA==
date: Wed, 19 Mar 2025 10:08:35 GMT
content-type: application/javascript
vary: accept-encoding, Origin
last-modified: Mon, 24 Jan 2022 15:36:43 GMT
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
via: 1.1 def26d054ec95b961e8352e3cd4fae7e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 404 mraid.js
1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 18E5 0
0 148ms
145ms Script
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/mraid.js

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Response headers

cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1591
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250415/r20110914/client/ Frame 18E5 3 KB
1 KB 431ms
149ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250415/r20110914/client/window_focus_fy2021.js

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ba1a463f7811ae10ea114a0bcc044c05c391ec1fcb3dd5a7bd9d9bb3fe2b070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14574132110251334613
age: 13058
x-content-type-options: nosniff
expires: Thu, 01 May 2025 16:00:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 16:00:06 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1242
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250415/r20110914/client/ Frame 18E5 18 KB
8 KB 419ms
138ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250415/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a14e84adb8fb9735a8e414b7e168f3e5ff9bad71acb1cef9d597355c6d744fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 11643015732383494192
age: 13054
x-content-type-options: nosniff
expires: Thu, 01 May 2025 16:00:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 16:00:10 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7916
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 18E5 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 18E5 221 KB
68 KB 400ms
136ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

cafe /

Resource Hash

3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18003062906086184080
age: 912
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 20:22:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 19:22:32 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69570
x-xss-protection: 0
server: cafe

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 6CC3 5 KB
2 KB 239ms
80ms Document
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 1309
apigw-requestid: JLg5xitMvHcESYw=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 931e60f60964cb9a-LAX
content-encoding: br
content-type: text/html
date: Thu, 17 Apr 2025 19:37:44 GMT
last-modified: Thu, 17 Apr 2025 18:28:14 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame A565 5 KB
6 KB 395ms
130ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=41427057&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 1729c2728c1c400b79781697710cfa82bdbcfddd996ff66beceac4040b971fe9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 4DEF 43 KB
11 KB 133ms
132ms Script
text/html 23.217.173.107
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.217.173.107 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-217-173-107.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: d5bac0b19c9b62dafe59ea2542333d9716a454baa9e65ce236f076f748d052fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=68213
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:34:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Thu, 17 Apr 2025 19:37:44 GMT
last-modified: Thu, 17 Apr 2025 14:34:37 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 3E39 43 KB
0 123ms
122ms Script
text/html 23.217.173.107
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.217.173.107 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-217-173-107.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: d5bac0b19c9b62dafe59ea2542333d9716a454baa9e65ce236f076f748d052fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

Response headers

cache-control: max-age=68213
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:34:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Thu, 17 Apr 2025 19:37:44 GMT
last-modified: Thu, 17 Apr 2025 14:34:37 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 227ms
224ms Fetch
application/json 162.19.138.119
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

847cd711a7c6c8c96c3e1377c8137219238332a9b815bc032b1418d230c280d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 2374 170 B
233 B 431ms
156ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 2374 170 B
410 B 423ms
148ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NGM3OTY1MjAtYjdkNy0yZGY3LWM5NmUtYzBjNjNkZDU2NjMy

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 2374
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=6016b6ea-7ea0-7353-dc8e-9a7ff737a852&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=MzRkOGQ2MmItNTBhMi00NjYyLThiNWMtYzE3NzY0NGUyNWZk&gdpr=0&gdpr_consent=&ttd_tdid=34d8d62b-50a2-4662-8b5c-c1776...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd&google_error=15
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5582797162784420863&ttd_tdid=34d8d62b-50a2-4662-8b5c-c177644e25fd
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

151ms
124ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 17 Apr 2025 19:37:46 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 2374
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/f4d1d0ae-ee0c-e11a-ed59-8c8a0860651b?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-dpkouoxE2p.PwbmxYAFQ5Ffo1wNDvECdmy4-~A

43 B
129 B

93ms
92ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-dpkouoxE2p.PwbmxYAFQ5Ffo1wNDvECdmy4-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-dpkouoxE2p.PwbmxYAFQ5Ffo1wNDvECdmy4-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 17 Apr 2025 19:37:44 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 2374
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAFYiQALGuA3VgBh

85 B
171 B

216ms
216ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAFYiQALGuA3VgBh
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1744918665.454911,VS0,VE0
age: 864
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/png
x-served-by: cache-toj-leto2350046-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 4346

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAFYiQALGuA3VgBh
x-timer: S1744918665.150677,VS0,VE86
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-served-by: cache-toj-leto2350046-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2374
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4334320726214499808&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

95ms
94ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4334320726214499808&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4334320726214499808&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 19:37:39 GMT

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 92B5 19 KB
7 KB 222ms
76ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33across.com=v1.0014000001YrMoYAAV.1040.7+hAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt/BC5rHvsL+/4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou/RODV4y0dVyuQXG4bGTNO5q0e0W/qRBKwbv5ueEw+efX5Lfa9r2nsphTizIcd/UbI37nWMb2OIz/wJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1/zurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw/L65Xw1KjBb0cIoFIwrWZ882c1/Bjq3/bZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl/dVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ+hqyH1tMSoMXnBhV/S9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9+0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo+YZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf/rFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh+IwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9/LHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb+il7UicLNB3a103DFFc3ZH8NTHIq1faY+CsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x/JCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3/ZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs/PIUuVzO/4T0s6A+vPOgyr9VPOlcjKxDRmR/pAYJo6P6svwssd43p8rrSz/Dp1qC3whbzSueANwyHCjG4d+u2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS+y6FnUCnEVCCuYfshzU//RYDwSbwHw+IGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9++G5phJb/lCz6HN6UlzMgeakibX+wDoQKksrwZmJ0yEcHFLXkFQWaXKm5F/0ppt+hR8rvyvMqD/c+L5AUoc1bX1h6918+1Jh5+Btp+Uq3lUB3JW8/3JNnYV52a4NGitd0OskzzDF/KNrH2XCoH6+8TELmACAxT7Ug&linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744918662798&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 931e60f6bebd24e5-LAX
access-control-allow-origin: *
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU2Yrj3OOySxbuYMYOKP4RYSxu3RGRyN-l-42YCTDjjsUjj43EyGhba1LbWNXHzPjn8zy41cFh5wClRUAFsCTcza3Q7vQ7LFSsyHiaWRQt-2Ky_waLvFLMTlboFWemI8m7Yhnc0YQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-004sFJlW4_f1d3OOYAvW0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0ZBi-FB_mfUHEAvxcHRsbD3AJtBwfdZuJiWXpPzC-OT8vJLUvBLdxJRiXRC7KDOptCS_CIWdWgZSkZOfnp6Zlx5vZGBkamBiaKZnYBZfYAAARTckFQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-004sFJlW4_f1d3OOYAvW0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU2Yrj3OOySxbuYMYOKP4RYSxu3RGRyN-l-42YCTDjjsUjj43EyGhba1LbWNXHzPjn8zy41cFh5wClRUAFsCTcza3Q7vQ7LFSsyHiaWRQt-2Ky_waLvFLMTlboFWemI8m7Yhnc0YQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-ibQJPS5HKaBe6OUzHz_7mw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw15Bi-FB_mfUHEAvxcHRsbD3AJrDi6MPdTEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAAYRokdQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-ibQJPS5HKaBe6OUzHz_7mw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUameMfOdvLGM1NaC1AHN7zhSYMvDVxET4VQZ_Sr_-a8GKLlj-DmBgiyDizO1fNG8fQMVkhrfHtroFh6zGiXjUgnfu8NxdhimwS_KajqBttT9Ph6HHciHamG6-koItXxFXGDeO4YQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 164ms
163ms Script
application/javascript 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUameMfOdvLGM1NaC1AHN7zhSYMvDVxET4VQZ_Sr_-a8GKLlj-DmBgiyDizO1fNG8fQMVkhrfHtroFh6zGiXjUgnfu8NxdhimwS_KajqBttT9Ph6HHciHamG6-koItXxFXGDeO4YQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTE4NjY0LDUwOTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ6WkdTRnhoQy16SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmRtY2dyYXRoYnVpbGRpbmcuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a8fcdca1015e85bc012f5bc5022b3cae1ac0d5226be6eb9e2f5952897d74acf5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dSRNMNsijxUQutFNOa3tcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmII1pBiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkFeLh6NjYeoBNYMLxKweYlDSS8gvjk_PzSooyk0pL8ovSktNSi1OLylKL4o0MjEwNTAzN9AwM4wsMAAWhOLc"
content-security-policy: script-src 'report-sample' 'nonce-dSRNMNsijxUQutFNOa3tcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame 92B5 4 KB
1 KB 100ms
98ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33across.com=v1.0014000001YrMoYAAV.1040.7+hAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt/BC5rHvsL+/4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou/RODV4y0dVyuQXG4bGTNO5q0e0W/qRBKwbv5ueEw+efX5Lfa9r2nsphTizIcd/UbI37nWMb2OIz/wJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1/zurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw/L65Xw1KjBb0cIoFIwrWZ882c1/Bjq3/bZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl/dVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ+hqyH1tMSoMXnBhV/S9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9+0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo+YZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf/rFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh+IwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9/LHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb+il7UicLNB3a103DFFc3ZH8NTHIq1faY+CsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x/JCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3/ZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs/PIUuVzO/4T0s6A+vPOgyr9VPOlcjKxDRmR/pAYJo6P6svwssd43p8rrSz/Dp1qC3whbzSueANwyHCjG4d+u2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS+y6FnUCnEVCCuYfshzU//RYDwSbwHw+IGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9++G5phJb/lCz6HN6UlzMgeakibX+wDoQKksrwZmJ0yEcHFLXkFQWaXKm5F/0ppt+hR8rvyvMqD/c+L5AUoc1bX1h6918+1Jh5+Btp+Uq3lUB3JW8/3JNnYV52a4NGitd0OskzzDF/KNrH2XCoH6+8TELmACAxT7Ug&linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744918662798&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8a679cf9c7d0b5d018fee0911a3b930d8e1bfb9705878fea0ad60adeff58455

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33across.com=v1.0014000001YrMoYAAV.1040.7+hAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt/BC5rHvsL+/4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou/RODV4y0dVyuQXG4bGTNO5q0e0W/qRBKwbv5ueEw+efX5Lfa9r2nsphTizIcd/UbI37nWMb2OIz/wJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1/zurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw/L65Xw1KjBb0cIoFIwrWZ882c1/Bjq3/bZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl/dVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ+hqyH1tMSoMXnBhV/S9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9+0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo+YZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf/rFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh+IwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9/LHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb+il7UicLNB3a103DFFc3ZH8NTHIq1faY+CsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x/JCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3/ZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs/PIUuVzO/4T0s6A+vPOgyr9VPOlcjKxDRmR/pAYJo6P6svwssd43p8rrSz/Dp1qC3whbzSueANwyHCjG4d+u2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS+y6FnUCnEVCCuYfshzU//RYDwSbwHw+IGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9++G5phJb/lCz6HN6UlzMgeakibX+wDoQKksrwZmJ0yEcHFLXkFQWaXKm5F/0ppt+hR8rvyvMqD/c+L5AUoc1bX1h6918+1Jh5+Btp+Uq3lUB3JW8/3JNnYV52a4NGitd0OskzzDF/KNrH2XCoH6+8TELmACAxT7Ug&linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744918662798&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 931e60f5d9677d65-LAX
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 628E 4 KB
5 KB 131ms
130ms Document
text/html 198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 9003128ef8bf572ac79adfb153cf3719154db37fc223c68af3b631d0ddf0fd82

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4239
content-type: text/html
date: Thu, 17 Apr 2025 19:37:44 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 92B5
Redirect Chain

https://ads.yieldmo.com/pbsync?is=ozone&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirectUri=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dyieldmo%26gdpr%3D0%26gdpr_consent%3D%26us_p...
https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcMAKZZCMAZdbo0GBLbD&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone

0
685 B

105ms
100ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcMAKZZCMAZdbo0GBLbD&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33across.com=v1.0014000001YrMoYAAV.1040.7+hAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt/BC5rHvsL+/4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou/RODV4y0dVyuQXG4bGTNO5q0e0W/qRBKwbv5ueEw+efX5Lfa9r2nsphTizIcd/UbI37nWMb2OIz/wJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1/zurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw/L65Xw1KjBb0cIoFIwrWZ882c1/Bjq3/bZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl/dVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ+hqyH1tMSoMXnBhV/S9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9+0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo+YZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf/rFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh+IwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9/LHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb+il7UicLNB3a103DFFc3ZH8NTHIq1faY+CsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x/JCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3/ZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs/PIUuVzO/4T0s6A+vPOgyr9VPOlcjKxDRmR/pAYJo6P6svwssd43p8rrSz/Dp1qC3whbzSueANwyHCjG4d+u2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS+y6FnUCnEVCCuYfshzU//RYDwSbwHw+IGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9++G5phJb/lCz6HN6UlzMgeakibX+wDoQKksrwZmJ0yEcHFLXkFQWaXKm5F/0ppt+hR8rvyvMqD/c+L5AUoc1bX1h6918+1Jh5+Btp+Uq3lUB3JW8/3JNnYV52a4NGitd0OskzzDF/KNrH2XCoH6+8TELmACAxT7Ug&linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744918662798&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931e60f9bcac7d65-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

location: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcMAKZZCMAZdbo0GBLbD&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
58 B 114ms
113ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 931e60f85f367bad-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:45 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 265ms
123ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 931e60f78e827bad-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:44 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame 6CC3 0
141 B 254ms
116ms Ping
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 931e60f92b732eb1-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 19:37:45 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 254ms
116ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 931e60f78ac62ac7-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:44 GMT
server: cloudflare
vary: Origin

GET
H2

200

xuid
eb2.3lift.com/ Frame E05C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=34d8d62b-50a2-4662-8b5c-c177644e25fd&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
475 B

137ms
136ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=34d8d62b-50a2-4662-8b5c-c177644e25fd&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=34d8d62b-50a2-4662-8b5c-c177644e25fd&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 17 Apr 2025 19:37:44 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame E05C 170 B
233 B 245ms
150ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E05C
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ1MDI4NDI5ODU2Nzc5MjkxNDc0

170 B
233 B

210ms
209ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ1MDI4NDI5ODU2Nzc5MjkxNDc0

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ1MDI4NDI5ODU2Nzc5MjkxNDc0
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:44 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame E05C
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ1MDI4NDI5ODU2Nzc5MjkxNDc0
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
140 B

141ms
134ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame E05C 0
249 B 332ms
129ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=445028429856779291474&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 2031C80653144649A36E51596BA5722D Ref B: LAX311000115031 Ref C: 2025-04-17T19:37:44Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYy/okwhSDEuoZ44yQG3A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 19:37:44 GMT

GET
H2

200

sync
thrtle.com/ Frame E05C
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=445028429856779291474
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=bb93848e-72a5-4d65-906d-fd177cf89afa&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=bb93848e-72a5-4d65-906d-fd177cf89afa&vxii_pid=12&vxii_pid1=7006&vxii_rcid=1c6e0a3e-115d-4ef6-a7b4-e9723566f2a3&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=1c6e0a3e-115d-4ef6-a7b4-e9723566f2a3
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=34d8d62b-50a2-4662-8b5c-c177644e25fd
https://thrtl.redinuid.imrworldwide.com/thrtl?url=https%3A%2F%2Fnlsn.thrtle.com%2Fsync%3Fvxii_pid%3D5036%26vxii_ts%3D2
https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=7036fd30-1bc3-11f0-ba77-7fd3b53fdae3
https://ib.adnxs.com/getuid?https%3A%2F%2Fnlsn.thrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D3%26_t%3D1744918666
https://nlsn.thrtle.com/sync?vxii_pid=5006&vxii_pdid=5582797162784420863&vxii_ts=3&_t=1744918666
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-sxD0iP5E2oTyJ7GB..MqFXmSgwrmqjArfCflTQ--~A
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=l4H4o9usXnRf-jhqjAfXQKL1zvU&_t=1744918667

43 B
540 B

134ms
133ms

Image
image/gif

34.197.53.184
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=l4H4o9usXnRf-jhqjAfXQKL1zvU&_t=1744918667
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 34.197.53.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-53-184.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Thu, 17 Apr 2025 19:37:47 GMT
content-type: image/gif

Redirect headers

Location: https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=l4H4o9usXnRf-jhqjAfXQKL1zvU&_t=1744918667
Content-Length: 120
Date: Thu, 17 Apr 2025 19:37:47 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame E05C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/445028429856779291474?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-mryJ5nhE2oTxLkk6c5PoafPbADqpBZKzzYkq7SMPwg--~A&dongle=0883

37 B
475 B

139ms
137ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mryJ5nhE2oTxLkk6c5PoafPbADqpBZKzzYkq7SMPwg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mryJ5nhE2oTxLkk6c5PoafPbADqpBZKzzYkq7SMPwg--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 17 Apr 2025 19:37:44 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame E05C 42 B
692 B 308ms
96ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=445028429856779291474&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "e8cf83ed75a9db1:0"
x-msedge-ref: Ref A: EBC36A34602A4121AB852DD74FDFCD60 Ref B: LAX311000115019 Ref C: 2025-04-17T19:37:44Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
last-modified: Wed, 09 Apr 2025 17:36:29 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame E05C
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=6302dadf4c1a1390&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHEZGCZXRX7gIAKjbWAQEBAQEBAQCXREDZ3AEBAQEBAQEB&expiration=1745005065&is_secure=true&gdpr_consent=&gdpr=0

37 B
475 B

138ms
137ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHEZGCZXRX7gIAKjbWAQEBAQEBAQCXREDZ3AEBAQEBAQEB&expiration=1745005065&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHEZGCZXRX7gIAKjbWAQEBAQEBAQCXREDZ3AEBAQEBAQEB&expiration=1745005065&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame E05C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-9781f8a3-dbac-5e74-5ffa-386a8c07d740$ip$162.245.206.245&dongle=4430

37 B
475 B

137ms
137ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-9781f8a3-dbac-5e74-5ffa-386a8c07d740$ip$162.245.206.245&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-9781f8a3-dbac-5e74-5ffa-386a8c07d740$ip$162.245.206.245&dongle=4430
Content-Length: 141
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

POST
H3 204 AGSKWxVSz9C9Ib0eDJIJuDHWBl9yOYFoZ3QVGq-n5wXkVqvdUDO732i76WNRxRnEZEx4XfbYIZloEwspoKRHwRu9_i37rWoMBammZTS6Qp8NxrAeAghfdbfJQW1c3kwQQZ5CZyjs03KjaA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 173ms
172ms XHR
text/html 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVSz9C9Ib0eDJIJuDHWBl9yOYFoZ3QVGq-n5wXkVqvdUDO732i76WNRxRnEZEx4XfbYIZloEwspoKRHwRu9_i37rWoMBammZTS6Qp8NxrAeAghfdbfJQW1c3kwQQZ5CZyjs03KjaA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-aDGL2TxlN4LxVZUAfMfFwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw1pBi-FB_mfUHEAvxcHRsbD3AJnBg9-YJzEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAASs8kJw"
content-security-policy: script-src 'report-sample' 'nonce-aDGL2TxlN4LxVZUAfMfFwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 setuid
prebid.intergient.com/ Frame 628E 0
834 B 241ms
163ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=be2cb90e-af9f-e712-8946-c1ae4bc95d46
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744918664&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=U1ry5gSGFqLNhoQFiS6vDyt3yid%2B4vi9w617FwOkTk8%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744918664&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=U1ry5gSGFqLNhoQFiS6vDyt3yid%2B4vi9w617FwOkTk8%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 931e60f78bb37c5f-LAX
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=5582797162784420863&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf

43 B
496 B

130ms
129ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:45 GMT
Etag: ca44f1aeaa024fdf
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_consent...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_c...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&us_privacy=1NNY
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf

43 B
496 B

131ms
130ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:45 GMT
Etag: ca44f1aeaa024fdf
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf

43 B
496 B

146ms
140ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:46 GMT
Etag: ca44f1aeaa024fdf
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=445028429856779291474&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf

43 B
496 B

132ms
132ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:46 GMT
Etag: ca44f1aeaa024fdf
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&sovrn_retr...
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

136ms
133ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:45 GMT

GET

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 628E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NkFFNTVGRDItNTI5RS00QzRBLThCRTEtQTZBNjE4NDg4MzFE&gdpr=-1&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=-1&gdpr_consent=&google_error=15
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

0
0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=36f0f071-3401-4ba9-b0a1-c5d734a56d7e
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf

43 B
496 B

131ms
130ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:46 GMT
Etag: ca44f1aeaa024fdf
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-133be4ce-e2a9-4fef-8076-52e41239d015
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf

43 B
496 B

130ms
130ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=ca44f1aeaa024fdf
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:46 GMT
Etag: ca44f1aeaa024fdf
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=09f97f289228cd2824933cf35a2317&_fw_gdpr=&_fw_gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

134ms
131ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 628E
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3879202651829370000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

138ms
131ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H/1.1 200
OK sync.html
sync.clearnview.com/ Frame 628E 734 B
734 B 411ms
134ms Image
text/html 204.62.12.186
NATCOWEB

General

Check archive.org

Download Go to Show image

Full URL: https://sync.clearnview.com/sync.html?gdpr=&gdpr_consent=&usp_consent=1NNY&pubid=17&pubuid=be2cb90e-af9f-e712-8946-c1ae4bc95d46&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dbrave%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D$UID
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.62.12.186 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

Transfer-Encoding: chunked
Access-Control-Allow-Origin: https://sync.cootlogix.com
Keep-Alive: timeout=5
Date: Thu, 17 Apr 2025 19:37:45 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 204 pbsync
ads.yieldmo.com/ Frame 628E 0
41 B 130ms
129ms Image
text/plain 54.196.189.26
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/pbsync?is=vidazoo&gdpr=&gdpr_consent=&us_privacy=1NNY&redirectUri=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dyieldmo%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%24UID
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.196.189.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-196-189-26.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

date: Thu, 17 Apr 2025 19:37:45 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 7E43
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
380 B

177ms
176ms

Document
text/html

23.217.173.107
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.217.173.107 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-217-173-107.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 19:37:44 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 0542 958 B
1 KB 96ms
91ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: be39583b4143c9d4b8ab1129981c6b221e18d15c6d906da691240349dea25856

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 958
content-type: text/html
date: Thu, 17 Apr 2025 19:37:44 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.245

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 62E0 0
573 B 423ms
137ms Document
text/html 2600:9000:261f:6400:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fuser%3FpartnerId%3Dminutemedia%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BpartnerId%7D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:261f:6400:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://sync.cootlogix.com/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
server: istio-envoy
via: 1.1 a410463cf33c032bf74ee26bf94b81b2.cloudfront.net (CloudFront)
x-amz-cf-id: S8vLTQ43GHLZGj4Fi6ukwBsNO2tylcT8ARsg3S3sojodeSLHsoaWTw==
x-amz-cf-pop: JFK52-P3
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 224ms
222ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

b2d2f8f39b0d67544ff9fcec954a8c3bb11999ef3ce10f79df35ac4de710d822

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: application/json
vary: Origin

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D5BC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1

43 B
806 B

89ms
87ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGKbN-LUCMAE&v=APEucNWywVvPf-z-d-5igvd2aDIuCS6b6DIfaLSRQyoLm3dImYOuAbNLqwz2QTPGFnmsf174e5zPZdTv-UBaOKIi6ZBsjzt_mFLoWErydK-AxBxHnxpM6_M
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SiiXaBdeGeitoj6deMTBpqL%2F5FSi3p%2FsaYlMWHJPLNJyX93hgkuv02Ndyx7obYzaXO%2FF4VhXwvH9jsuHpmXWFBCC%2FO9E%2BAr1nQUb6%2BGgAwgaozPjQPZegf5Mjlbf%2FlDZtu1BZ5MHevu6Vg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931e60f9a9472b7c-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HmkfINDcDEkuzsa2ehyue4x37y3F8%2BRvMbYiGEu7ARPc9e9X8VXnU0NqKvkRoKg1bL8iqe2C63w49%2Bv3%2FvBpe1oUKoLBzSrH0PFYpnTNsD1UmAOY%2BZ9Du7xRnTzmKIOawbuw%2BMGCKWvZYw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 931e60f86d34f7ab-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 19:37:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D5BC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAFYiMAoImIAFsfiAYU5RwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
766 B

94ms
93ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGKbN-LUCMAE&v=APEucNWywVvPf-z-d-5igvd2aDIuCS6b6DIfaLSRQyoLm3dImYOuAbNLqwz2QTPGFnmsf174e5zPZdTv-UBaOKIi6ZBsjzt_mFLoWErydK-AxBxHnxpM6_M
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pnb3HLCNRFnI4KPB4AQ7I7kUkJ3X7Tm6VWns%2FBAmZz2c44iM9FBw0d66uLKwjf%2Fy4gEaWud2krXpVOV68yrV%2BN9xJ9PTXFxCauYKA792TGTFfj9m%2F7esjcSi3IrWsr7V0L6DZmXSotO0yw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931e60faaaa82b7c-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame D5BC 170 B
233 B 190ms
155ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGKbN-LUCMAE&v=APEucNWywVvPf-z-d-5igvd2aDIuCS6b6DIfaLSRQyoLm3dImYOuAbNLqwz2QTPGFnmsf174e5zPZdTv-UBaOKIi6ZBsjzt_mFLoWErydK-AxBxHnxpM6_M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:44 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame D5BC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU4Mjc5NzE2Mjc4NDQyMDg2Mw%3D%3D

170 B
233 B

147ms
146ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU4Mjc5NzE2Mjc4NDQyMDg2Mw%3D%3D

Requested by

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU4Mjc5NzE2Mjc4NDQyMDg2Mw%3D%3D
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.245; 162.245.206.245; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: b3e15630-40c7-40ac-9e95-c010e0864eee
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 298ms
157ms Fetch
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504160101/pubads_impl.js?cb=31091816
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s77-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0542
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openx&userId=9299c78f-f1fb-48e5-a384-d87b46901c39&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg05ALZHIcPUIJtoRuScYIMO&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=6855d5a81a3118d6

43 B
496 B

131ms
130ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=6855d5a81a3118d6
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=6855d5a81a3118d6
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:45 GMT
Etag: 6855d5a81a3118d6
Server: Adtelligent

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0542
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=5582797162784420863

43 B
61 B

93ms
92ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=5582797162784420863
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=5582797162784420863
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.245; 162.245.206.245; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 106f43e6-10f9-4c3b-97cb-fbe6f4d9dd78
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 0542
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=35d0c98c-b3e7-4533-83f7-1a8cceacc98a
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=35d0c98c-b3e7-4533-83f7-1a8cceacc98a

42 B
60 B

117ms
114ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=35d0c98c-b3e7-4533-83f7-1a8cceacc98a
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=35d0c98c-b3e7-4533-83f7-1a8cceacc98a
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 0542 95 B
767 B 232ms
94ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=6668c516-25a7-4ed4-966f-02a9c4bb695e

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0542
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&gdpr=0&gdpr_consent=

43 B
61 B

92ms
91ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0542
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=e36331fd-c3c8-47b9-a98b-1108df678f0d

43 B
61 B

91ms
91ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=e36331fd-c3c8-47b9-a98b-1108df678f0d
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: b576c18f-fb34-473a-88d7-36022c623899
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=e36331fd-c3c8-47b9-a98b-1108df678f0d
Content-Length: 112
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame 0542
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=v0A81tcmyn06-tbIJC6S6A==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
108 B

258ms
254ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame F665
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=0&gdpr_consent=

35 B
592 B

134ms
129ms

Document
image/gif

185.167.164.48
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 7C30
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

153ms
152ms

Document
image/gif

98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-98-82-154-76.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 17 Apr 2025 19:37:45 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: R15AR7RP51CFVVYTMG8G

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:45 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: XG0N1YTMPNG2PHDEM8CG

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2452
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5582797162784420863&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
7 KB

131ms
130ms

Document
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=161971
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 321
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame C6BE 0
340 B 452ms
132ms Document
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Thu, 17 Apr 2025 19:37:45 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E5AB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=l4H4o9usXnRf-jhqjAfXQKL1zvU&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
0

1ms
0ms

Document
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=161971
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 321
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 213D
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=979321856265558953
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
0

0ms
0ms

Document
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=161971
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 321
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 715D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
144 B

215ms
215ms

Document
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAFYiQAAAZtKvgA_
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 864
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 17 Apr 2025 19:37:45 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 4346
x-robots-tag: noindex
x-served-by: cache-toj-leto2350046-TOJ
x-timer: S1744918665.454937,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAFYiQAAAZtKvgA_
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-toj-leto2350046-TOJ
x-timer: S1744918665.150589,VS0,VE87

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame B183
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCZE0wN1FBckVBQUJ2YlowSmVZUQ&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AABdM07QArEAABvbZ0JeYQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_par...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AABdM07QArEAABvbZ0JeYQ&pid=558502&do=add&gdpr=0

43 B
433 B

129ms
128ms

Document
image/gif

52.70.147.192
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AABdM07QArEAABvbZ0JeYQ&pid=558502&do=add&gdpr=0

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.70.147.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-70-147-192.compute-1.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Thu, 17 Apr 2025 19:37:46 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-US
cw-server: bh-deployment-cc58c7bc8-gkjt7
expires: -1
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AABdM07QArEAABvbZ0JeYQ&pid=558502&do=add&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(12.0.17)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C3C9
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=50572fa4-dfec-4f39-b562-b8b7695c2ca9&ssp=pubmatic&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10609073349787078929&ssp=pubmatic&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10609073349787078929&ssp=pubmatic&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=pubmatic
https://x.bidswitch.net/sync?dsp_id=419&user_id=10609073349787078929&ssp=pubmatic&gdpr=&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
301 B

137ms
136ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 13:49:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 17 Apr 2025 19:37:46 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame F622
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=3fc68f93-66e8-4218-ace2-622acdc6b015&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D

42 B
493 B

128ms
127ms

Document
image/gif

54.82.23.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.23.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-23-141.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Thu, 17 Apr 2025 19:37:45 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 17 Apr 2025 19:37:44 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 1C90 0
0

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame C2A6
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=o80DaqDNC2K4wQpspcQeY6eWVz-4kQA6o8a6a9WK
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
495 B

131ms
129ms

Document
text/html

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

content-length: 178
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:44 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame ED9C
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=6f93cbc0-1bc3-11f0-90ec-b3c489dfdb4b
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
495 B

265ms
130ms

Document
text/html

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Thu, 17 Apr 2025 19:37:46 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

content-length: 178
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:45 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F47F
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
0

1ms
1ms

Document
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=161971
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 321
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4329
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:7c416801-5889-4000-8344-5ed1d1b65c8d&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
0

0ms
0ms

Document
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=161971
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 321
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:37:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame 08AB
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=khC8BqMZGfMW0wPoVNJETaEuY3PNcisCbs_bTy7r5Kw&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1N...
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=1NNY
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
495 B

278ms
130ms

Document
text/html

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Thu, 17 Apr 2025 19:37:46 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

content-length: 178
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:44 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame D333
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU4938355fc366443589aad3eb80a9871d
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
495 B

135ms
129ms

Document
text/html

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Thu, 17 Apr 2025 19:37:46 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

content-length: 178
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:45 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame B7E7 0
181 B 425ms
129ms Document
text/html 138.197.63.78
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.63.78 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame A565
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=35d0c98c-b3e7-4533-83f7-1a8cceacc98a

42 B
319 B

115ms
113ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=35d0c98c-b3e7-4533-83f7-1a8cceacc98a
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=35d0c98c-b3e7-4533-83f7-1a8cceacc98a
pragma: no-cache
x-forwarded-for: 162.245.206.245
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200
OK

/
bidberry.net/ Frame A565
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-BroVZKJE2pRZ_POqalKJqr.7zQeeN_709g--~A&gdpr=0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=0aaac793bb1966944aa971be60d26d9a&gdpr=0
https://bidberry.net/?partner=1&mapped=a9bf278bfbe0e6ca&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/map/c=14544/tp=BIDB/gdpr=0/gdpr_consent=?https%3A%2F%2Fbidberry.net%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D%26redirect%3D
https://bidberry.net/?partner=104&icm&cver&mapped=8f4dfc5ab088ddce86f31f7f763f9d3b&gdpr=0&redirect=

35 B
245 B

227ms
224ms

Image
image/gif

57.129.39.243
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://bidberry.net/?partner=104&icm&cver&mapped=8f4dfc5ab088ddce86f31f7f763f9d3b&gdpr=0&redirect=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 57.129.39.243 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3235992.ip-57-129-39.eu
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-type: image/gif
content-length: 35

Redirect headers

expires: 0
cache-control: no-cache
location: https://bidberry.net/?partner=104&icm&cver&mapped=8f4dfc5ab088ddce86f31f7f763f9d3b&gdpr=0&redirect=
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Thu, 17 Apr 2025 19:37:47 GMT
pragma: no-cache

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame A565
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&sInitiator=external&gdpr=0&gdpr_consent=

42 B
604 B

122ms
120ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 10
Pragma: no-cache
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Length: 42
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 3
Pragma: no-cache
Connection: Keep-Alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Length: 0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A565
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NkFFNTVGRDItNTI5RS00QzRBLThCRTEtQTZBNjE4NDg4MzFE&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
20 KB

132ms
132ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=161970
content-encoding: gzip
expires: Sat, 19 Apr 2025 16:37:16 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 17 Apr 2025 19:37:46 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 17 Apr 2025 19:37:46 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A565
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

10 KB
10 KB

135ms
130ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=161971
content-encoding: gzip
expires: Sat, 19 Apr 2025 16:37:16 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 17 Apr 2025 19:37:45 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame A565
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

130ms
129ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 178
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: text/html; charset=utf-8

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A565
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:522DC5776C58492BA1E56DE1EC48DC3F
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

4 KB
4 KB

131ms
130ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=161971
content-encoding: gzip
expires: Sat, 19 Apr 2025 16:37:16 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 17 Apr 2025 19:37:45 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame A565
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=

42 B
333 B

404ms
126ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=34d8d62b-50a2-4662-8b5c-c177644e25fd&gdpr=0&gdpr_consent=
content-length: 355
date: Thu, 17 Apr 2025 19:37:44 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame A565
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-j5Q5oItE2uUI_Yq30uo1TwVFGqdmJug-~A&gdpr=0

0
262 B

445ms
131ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-j5Q5oItE2uUI_Yq30uo1TwVFGqdmJug-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 19:37:45 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-j5Q5oItE2uUI_Yq30uo1TwVFGqdmJug-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: text/html
server: ATS

GET
H2 200 6AE55FD2-529E-4C4A-8BE1-A6A61848831D
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame A565 43 B
521 B 158ms
144ms Image
image/gif 2600:1f18:4e9:5a02:bbc0:d5bd:401f:9d0e
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/6AE55FD2-529E-4C4A-8BE1-A6A61848831D?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:bbc0:d5bd:401f:9d0e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 2
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame A565
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e8a558bc-7242-43d7-ace4-1c1b3a7ac2fe&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

140ms
129ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 178
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: text/html; charset=utf-8

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A565
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

4 KB
4 KB

132ms
131ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=161971
content-encoding: gzip
expires: Sat, 19 Apr 2025 16:37:16 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 17 Apr 2025 19:37:45 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame A565
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=73cef186f59b22ec&is_secure=true&networkId=17100&version=1&nuid=6AE55FD2-529E-4C4A-8BE1-A6A61848831D&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQANoUiauhDXhgJgoYsXAQEBAQEBAQCXREDYoAEBAQEBAQEB&expiration=1745005065&nuid=6AE55FD2-529E-4C...
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
96 B

122ms
122ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 19:37:44 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Thu, 17 Apr 2025 19:37:46 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame A565 0
36 B 439ms
129ms Image
text/plain 54.205.103.53
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.103.53 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-103-53.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 17 Apr 2025 19:37:45 GMT

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A565
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4334320726214499808&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=auVf0lKeTEqL4aamGEiDHQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

4 KB
4 KB

131ms
131ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=161970
content-encoding: gzip
expires: Sat, 19 Apr 2025 16:37:16 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 17 Apr 2025 19:37:46 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame A565
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_126EDBABA_4C30D9BC&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

135ms
134ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-427923465; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Strict-Transport-Security: max-age=-427923465; includeSubDomains
Expires: -1
Cache-Control: no-cache
Content-Length: 43
Pragma: no-cache
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 13:43:25 GMT
server: nginx

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 7F35 0
926 B 194ms
135ms Script
text/html 68.67.181.231
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.231 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.245; 162.245.206.245; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 278be615-838b-43d2-8675-6fee574708a1
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18E5 0
20 B 159ms
159ms Ping
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=482599950809&version=m202504010101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18E5 0
20 B 157ms
157ms Ping
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=482599950809&version=m202504010101&ct=77&x=1&cor=15429908711735804000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 18E5 46 KB
23 KB 181ms
180ms Script
text/javascript 142.250.65.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CerXIXa5GG45V88fPEYsl2JGmXgGQpvxIKEtJ7XN25LMs68nGH7O_KCMjrgRrtaUECZYRVwwWx6er_REk-w1OpLXCR3CBiQ6ys0Y1uk9AeP6FYmWp3s_jHgEokyMofWL2ZU7BKkOYjaUqwP3b8F0hSHXTAp9MVokQxtGu3KsnTaEPwAEj5iSx7gB5GjRRU7tzGL0CxN2uAX-9WVoAB4B-vhHzmz576t2Ra6Qok6vDtnxfBBzc0Eq90pWVRQbLs2nS-yO3I9ALe7wh9YTNAMfMUf7mSkQ&dbm_d=AKAmf-DrGJ3OZhcL0gxE8VbV00xonu2e92kWmUhxKEW5JfpFRyAR8SaJ0mNH57tqJdHtxWJR3AxBgR_Y6Lk8ifzHP9Wl29KbiN5f_rU7Xa9T5sTKgOvs412CpmoiYpNgivVze_lXpyWPv-2-dhQW7-kJY-4CUe9qzrV5kjDHN3-EIRh0Pwv1AbqbN32TSeDi7Uz-PV8hfOEjgkNLpSSdGVQ2fqipWrbBj7nKMHjMLpyEQEbTgDt_JQXW0DFsZRAxRKB7LJnQT57ztg1emCJTwLI78rArgp_0QqqBcKuecwozexOvn_vz9dfFLYf1E7cUP44TZJuMBG6jiBTaOB9cox0Xt_LQSxJYWUQJEytoEWNcuUBBfXU5RrrU5MWu23ytv2bG9uMmcCmvn6gR38FAH80T5ip1cgB5qS94pooxQ6QTapuLCJDVmyN31EwRE6w-bG2dhrNrkeM8Yd9On0ned9udh4IJp6EFBANsB1mQGxBFoTrlPITfT-HjwSm5xozZpwhJ-EbYFxaT5aAYyDIuo9oiVyCB4R9eUTdoOz-EtztnGPiUD_LCZhli6zJzTyi7A-Buctttry5dVhq57HWms7UXKgoEvngLJ_NBSBLVcNSfMhn8lnADijyRwkuCZDPvh1la-zSNVqOH_EYUkKA3xCllqYRdWQP_moKxkPVSVSKk8FQGO56kLnkqL0fmAT9zdK-Czuc0meaOMo5VV0NBXgIz7SYovyAld9yRaYGR6rh7XVUP3bcBPx6TT7Us4pIf4zZFJsrnpLtw8ZhGrkcrkGczLO4R7HkVukhDG5Y8i9lxOQPIV-am3GaeYWh44ZLE_ARwQ7WqZ31vHs3jkJbpOE8qzKhuhdCuA7UI4ADqYTGSZzjJuVrzUOyTnWqyc5_4JnODd5vqmdvz4dNe9wW7-J0sz4UBTMTTH7D8f1z5Uqu1zgFsjALIj9j3rTsUZpZtD54TnpyOLhc2sOguV9kk_bB5DeclT9P-WKAhc3cBLaiuQ-Mgipcwyb4ZLLTq1RKWHfy6QYug7EeltjrcaXxQdQV7DahTgQLasvxTmBU0Z0nEE-rvFSaPCAS0G4ek1QGF22HdiSpioOapfHFZnuQ6ike5Ew5xQ7pxtjsHvRJIACMHKDybj4Ac-xohu5RNDPHRlrr68uQhnUTk1EGcQYhZLkNInDDymhJ0coIFHaYMB-dubohXmGG2jefUmnuXsQZ2WeTOHoakGmhMyvYylIogyWf6q_soaS47UBWCjDtV-HETrk4nWn4DpuyzLGajm7fo1fT2Zcqfk_8_sqNckELc0twF-HimlxQtV67roFIs-_O1BkdP7XqaTZMvhj5Kguq_2eWTlXe4orP0fwjB4cgaIAUT4w26dJulWdJqBBZC5y12ne0VIyaz1oG6U2RVNu-gx7i0ZV0B9OGngXAx4dI5p0rnksG-YiU3Oge9mc4ONs_DTv0c_yuZq8hFRVWgDfyex220cGySX-NHWI_uEAeqsoG_b_jDdl7OpEXCILNZi37vgMiRdSvTY7g3mx2UwsUaAGJ1j0miQApjxCmYEvw-j8L1dGverSbAxbNX3IH1YdSGgRXhKXdogbV0CVgbsM_XvMC6a5iuZKf0Pv1IjEbWpwkjE5OIeFnJkfIHQZlqOzjob5L8AeU6GtvAPjndf8w2O1at4S2UBbpDXdGJBTG0Tfz68I_PgrFmE8CwRwe3KRkAjuxOc4cd8Zp9-IVSFWbTCJ0S-z74clYEEXw--nruQD8slgWTUulQz2sDg_OycUHjmKw3uRS6ywQHNgSsku_vwVulEvjZVzlJCP3dWgOaTpWbRy9D9NtLMxzkqd8bJ0-H2ocx3EL-OpC4DDjebmzrSCen4Bo05N280ULqb5X7-lHDr9Nal1V8iFYOIFvW7ke23svxW8kqmvhaZj3OZVUDOQGWN94bVwRC-ZVkBlnc-ubeD9ySByX7GumJ-Hsa28Qs0pWBdoh5IAGFVaWw0TsyZuHwMJaRuvXw8snrWu2lu7yf-UA-GFZ8rwgUsZMNZbHT1tMBo4Aw2Up75vSbi21Mm26YxeT243iSD55cEPkU0G541H2JtOHV70t66MWEXQxtqmQKCa-1aeLOtzhGlrrGFHGYM28Z68EYTBLqN822SjTk3Wg1M3js9I-XukM5rLVweTuFrP1UIqHdEafWQaXbGcrDAFsqpu1uGVFturIIDFCd3hnqFkSZ9-OEoCQpIJaTnVc-8zjnS5IA6jhq4AFZEmgVrfq06d7GHKjWP5ozVQiXa8zjRSuTJ8X1OvXcr3r6buJxWBEjO6kr8AjLT-qnEujkLRa0-HQcvnUnpgoL7gOWV_1sCxKOxsj18wGuqisqjB6BNSeXxiEJDsXv46J8JygFYeiS90EI4pKnhoOu_cUO6-NYuUcOrW6p9_Wd0HfmljAEzKlhhNB9jEAujHJztCrLdVBUXQvkQTd_zn1RoNDrU0PubR95J5YgdxoibHBOw32wcAqj0mf1FLfEunH74UYfaASZTj5jg7ZGfM09TrghWPXdRVLZgwE2iG2SfUzKjwSbEvuMMuGYXujjXJ1LZw-t7JoX2A7XSzmmca5bZjOLnlch_1gDRmpXU2K11dxiAMQfMUuhGa5munDLZ3MU3s8OGY3xsmErHFobsSBcUR4W6-QW1OagmrbqOmQhviba4jdPVwnHi8lvkPeV1YlhgR4scujeOaYS-btngkkrZHjD1HQbFgnzdGFmJtbSic-rQiRJGL22jhBXcuACxTa5pDpbOtBKUlauPKdD2sQefe736VGGT2wMH-Wyzg7fZn-HH3Xzg2UGmEsZ_Rv8lJUqiajpZTR3vOLRY_lLzqSUY_9fa1hBfGO-lz50ragDFN2tLVR5Lghlz-blZyvRjZMjeYrmHWs6kGS48BKKMNZhRmrikrFfUx_E6waZiZdGkgWdS4VFqPittajGjbZhHkeSdJsOFPpKGkjHe97SQtq-_3MLpcT2-GUG9kg2N11jpAwlxrAV_SYeTQAQp0NDl-NyjXxKuquJg_yQUEJII8_Vi04Fjvvfp7ohshJuQWDUh7wEwU2KpCZmjI0NlmCNN_tEXKBks86klMmPg5CaV8h_eSUucsKbxO-R3diCXYtpgFm_KLUMoi9bdPNzufryYYYwtMTpRelNPzbifBlSAWVGCULe-zvWF3_12YMn8x6aDmtgbEhQIyKXhCq8duCPes8P11Xxuk0lFVBTcau1qU_NsmAGnMiXYg-DjFh84y3XvcEVe54BihFMlY1zNj5jltYbA4RoxPaG-e1MLCLSuU22U3h37KSMNxFE6tACO1kM--Zf8z375gS80CMLB_V8lt2_T98BNQVuBcxmMLsuSsepyOvBowNuv2ugNOm8rLjkAl3vH7yxAYeAxoenDYz4Alx7FbVbbqG648CW6wRwBjh4LT0hIg13OgxxIvUI88VU37GCYAmNdiMimBxyxaQOyUpAdFg8n6Al1l1pIQrQUmMcboOb7ivkj5nYcYoO_eTHX2LyIMmUDeQ19bzdLFjhySTb5aghYSBdifAZMvX6lO2J9dpiVkwC8DhHGTQ2C9dpkChS6i9SGlhY-oyjQUCsMBUDwtRfCdE6yBcZ1RHWWW8kgu-B9YDRIElMJQ5D28pJzpweHbw7VnpQ4vqAaESmUJ7JUjiHX4EmabOxuzh4xEjelAGKvP8JXHnFg04iAZIvnpVpN1QpxMsBkReYVJu26eBTV9muHV8_NO24eoNGCrRBLgbEwgt3g2TnA9b1-jLpeiP0awCAu74x1TionqQZ2l7_KNKOKZh5EkyVG3nEfwFTm5bil9vfG3W51Z0WyjxnUcAnKbbNjRFF10Qkxw2iJw41SHDq9e9NN9oznu_DzHxyraVB_iIVshkbjDtUHdjeX8UtMLJCU2rja1eCrjLRBLq_pWynCfhgBHhg3LF2Qj1TQ1IrAFTIfOYBErd35ryisNUxvoKa9gQTM5zDYPErzGu-2Sqm4KDc91at46pFNSfrhMMXcAm6T4pD4IhvSZrrOGgNBjB9danMIctlSfqIe8DeAZ3y-vxuAkpAXrRdN-QHg-Xqgcw_pC05WSnf8vdDNCVZ3-HyH49RmjU9P-VLlfXL2Co-xuOGaOa9hubOK0GJFV4piYZCsYyCMwFCBqk_hGtoql9cSkiCT5-ARNrL4OrQTfQZ-DskfmT6hHlBtbzjy1xE-T6SgHmsU1pgiuTjkziFycuKPG27ZqgEbu9RO46IEFh33A-RonZLtXK5FH7XIWd49t6rhJvS56F7q3Fw80-z3n8iBW_9fmstvTrfyXNnTp-hGfbuts0NCWubJnfLjzHag2LKaxw-esgzK0ITb5lU2BOaFO4WJE7KVTvg14DfIqxJ60ZfFhvWkvReDMHGVZbfhbxAppG6JpsIuWLDNw5fmJAauTsZdxVPY8AbLf5EpXIX8X5hQlgQH_EZyDfB__QLyMQ4qzTsvJQik9hyR-s0Lbb6d9_1vM0T-91bmlfmdNRgMm7t7vc3-yGr8IZ9c9YhH2Gn8q6DKlMGTCupXpMrGz6kgbGFnK6n1Lv5XBczolh-GJOmfnNGDIBQuXWunD7EXt9YB3CAvpCzj0mPHJwTqhA1II_JTnhj15EaSg7nvo29SecblVyJHisOkcCD_qLq5_pz0cBEId-hLEpTm8g--sdEji4HFOqqksh_V2A0WDr2oYGQNv9t7nhFVP3XkZBv5l3yJ_sYjZPfUdSDNM_dzDJYmH-41366PqNoYReyar4Zirvy0G12omWu79mjicYnCB0FzAKPtNdZz7_UDXLxUrDA538RdXdV4yl5KoHwZwfbgb6cAfmrmlueLQVtdeFADwCXmKQC9d6A8ZltbDIj-m0NftNZXkWSPPsWpYOQj6W9Raq5SioEcsvwhjP9xr5Ws4IRtASZCar-C_LbnNcRg0Wv0cw7zom_ANpKPTNIwQiBoC_6tdEvui_X_QfcHguukNkQwWygqISzIFs9tG2iEytyhRUPomgCQteYR6ROyZ_hIjj_A2MZ3OAn_jcBIkGBjAEuKzG3N1j92LN9P_FVoTjaI_N6IRa5ySFR3BXtQdMsHtBk0a6QcDXNFtbQSyibmhpjkvTQO2wQz2TAe_cJcKxiGN3eN1vN2_CmphNCvcLAMMuFPgcY&cid=CAQSOwDZpuyz0I7HSycNjniZZLtG-t1hoo9b979uOTJzrOiAua9i6sREkEjxyoUNAV8p6uyQ2bAcJonlTVwqGAE&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=77&iif=1&cor=15429908711735804000&adk=1033480540&idt=675&cac=0&dtd=144

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f2.1e100.net

Software

cafe /

Resource Hash

efc5b6de1aa41e8476b138522c7d9c3891283a89ae19cf5e7916128b54c8258b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 23436
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 7E43 43 KB
0 123ms
122ms Script
text/html 23.217.173.107
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.217.173.107 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-217-173-107.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: d5bac0b19c9b62dafe59ea2542333d9716a454baa9e65ce236f076f748d052fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=68213
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:34:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Thu, 17 Apr 2025 19:37:44 GMT
last-modified: Thu, 17 Apr 2025 14:34:37 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 3E39 7 B
1 KB 496ms
124ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
content-length: 7
content-type: application/json; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 1C90 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1C90 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9632 20 KB
7 KB 131ms
130ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33across.com=v1.0014000001YrMoYAAV.1040.7+hAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt/BC5rHvsL+/4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou/RODV4y0dVyuQXG4bGTNO5q0e0W/qRBKwbv5ueEw+efX5Lfa9r2nsphTizIcd/UbI37nWMb2OIz/wJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1/zurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw/L65Xw1KjBb0cIoFIwrWZ882c1/Bjq3/bZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl/dVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ+hqyH1tMSoMXnBhV/S9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9+0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo+YZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf/rFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh+IwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9/LHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb+il7UicLNB3a103DFFc3ZH8NTHIq1faY+CsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x/JCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3/ZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs/PIUuVzO/4T0s6A+vPOgyr9VPOlcjKxDRmR/pAYJo6P6svwssd43p8rrSz/Dp1qC3whbzSueANwyHCjG4d+u2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS+y6FnUCnEVCCuYfshzU//RYDwSbwHw+IGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9++G5phJb/lCz6HN6UlzMgeakibX+wDoQKksrwZmJ0yEcHFLXkFQWaXKm5F/0ppt+hR8rvyvMqD/c+L5AUoc1bX1h6918+1Jh5+Btp+Uq3lUB3JW8/3JNnYV52a4NGitd0OskzzDF/KNrH2XCoH6+8TELmACAxT7Ug&linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744918662798&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://elb.the-ozone-project.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=161971
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 19:37:45 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250415/r20110914/ Frame 18E5 28 KB
10 KB 135ms
133ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250415/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CerXIXa5GG45V88fPEYsl2JGmXgGQpvxIKEtJ7XN25LMs68nGH7O_KCMjrgRrtaUECZYRVwwWx6er_REk-w1OpLXCR3CBiQ6ys0Y1uk9AeP6FYmWp3s_jHgEokyMofWL2ZU7BKkOYjaUqwP3b8F0hSHXTAp9MVokQxtGu3KsnTaEPwAEj5iSx7gB5GjRRU7tzGL0CxN2uAX-9WVoAB4B-vhHzmz576t2Ra6Qok6vDtnxfBBzc0Eq90pWVRQbLs2nS-yO3I9ALe7wh9YTNAMfMUf7mSkQ&dbm_d=AKAmf-DrGJ3OZhcL0gxE8VbV00xonu2e92kWmUhxKEW5JfpFRyAR8SaJ0mNH57tqJdHtxWJR3AxBgR_Y6Lk8ifzHP9Wl29KbiN5f_rU7Xa9T5sTKgOvs412CpmoiYpNgivVze_lXpyWPv-2-dhQW7-kJY-4CUe9qzrV5kjDHN3-EIRh0Pwv1AbqbN32TSeDi7Uz-PV8hfOEjgkNLpSSdGVQ2fqipWrbBj7nKMHjMLpyEQEbTgDt_JQXW0DFsZRAxRKB7LJnQT57ztg1emCJTwLI78rArgp_0QqqBcKuecwozexOvn_vz9dfFLYf1E7cUP44TZJuMBG6jiBTaOB9cox0Xt_LQSxJYWUQJEytoEWNcuUBBfXU5RrrU5MWu23ytv2bG9uMmcCmvn6gR38FAH80T5ip1cgB5qS94pooxQ6QTapuLCJDVmyN31EwRE6w-bG2dhrNrkeM8Yd9On0ned9udh4IJp6EFBANsB1mQGxBFoTrlPITfT-HjwSm5xozZpwhJ-EbYFxaT5aAYyDIuo9oiVyCB4R9eUTdoOz-EtztnGPiUD_LCZhli6zJzTyi7A-Buctttry5dVhq57HWms7UXKgoEvngLJ_NBSBLVcNSfMhn8lnADijyRwkuCZDPvh1la-zSNVqOH_EYUkKA3xCllqYRdWQP_moKxkPVSVSKk8FQGO56kLnkqL0fmAT9zdK-Czuc0meaOMo5VV0NBXgIz7SYovyAld9yRaYGR6rh7XVUP3bcBPx6TT7Us4pIf4zZFJsrnpLtw8ZhGrkcrkGczLO4R7HkVukhDG5Y8i9lxOQPIV-am3GaeYWh44ZLE_ARwQ7WqZ31vHs3jkJbpOE8qzKhuhdCuA7UI4ADqYTGSZzjJuVrzUOyTnWqyc5_4JnODd5vqmdvz4dNe9wW7-J0sz4UBTMTTH7D8f1z5Uqu1zgFsjALIj9j3rTsUZpZtD54TnpyOLhc2sOguV9kk_bB5DeclT9P-WKAhc3cBLaiuQ-Mgipcwyb4ZLLTq1RKWHfy6QYug7EeltjrcaXxQdQV7DahTgQLasvxTmBU0Z0nEE-rvFSaPCAS0G4ek1QGF22HdiSpioOapfHFZnuQ6ike5Ew5xQ7pxtjsHvRJIACMHKDybj4Ac-xohu5RNDPHRlrr68uQhnUTk1EGcQYhZLkNInDDymhJ0coIFHaYMB-dubohXmGG2jefUmnuXsQZ2WeTOHoakGmhMyvYylIogyWf6q_soaS47UBWCjDtV-HETrk4nWn4DpuyzLGajm7fo1fT2Zcqfk_8_sqNckELc0twF-HimlxQtV67roFIs-_O1BkdP7XqaTZMvhj5Kguq_2eWTlXe4orP0fwjB4cgaIAUT4w26dJulWdJqBBZC5y12ne0VIyaz1oG6U2RVNu-gx7i0ZV0B9OGngXAx4dI5p0rnksG-YiU3Oge9mc4ONs_DTv0c_yuZq8hFRVWgDfyex220cGySX-NHWI_uEAeqsoG_b_jDdl7OpEXCILNZi37vgMiRdSvTY7g3mx2UwsUaAGJ1j0miQApjxCmYEvw-j8L1dGverSbAxbNX3IH1YdSGgRXhKXdogbV0CVgbsM_XvMC6a5iuZKf0Pv1IjEbWpwkjE5OIeFnJkfIHQZlqOzjob5L8AeU6GtvAPjndf8w2O1at4S2UBbpDXdGJBTG0Tfz68I_PgrFmE8CwRwe3KRkAjuxOc4cd8Zp9-IVSFWbTCJ0S-z74clYEEXw--nruQD8slgWTUulQz2sDg_OycUHjmKw3uRS6ywQHNgSsku_vwVulEvjZVzlJCP3dWgOaTpWbRy9D9NtLMxzkqd8bJ0-H2ocx3EL-OpC4DDjebmzrSCen4Bo05N280ULqb5X7-lHDr9Nal1V8iFYOIFvW7ke23svxW8kqmvhaZj3OZVUDOQGWN94bVwRC-ZVkBlnc-ubeD9ySByX7GumJ-Hsa28Qs0pWBdoh5IAGFVaWw0TsyZuHwMJaRuvXw8snrWu2lu7yf-UA-GFZ8rwgUsZMNZbHT1tMBo4Aw2Up75vSbi21Mm26YxeT243iSD55cEPkU0G541H2JtOHV70t66MWEXQxtqmQKCa-1aeLOtzhGlrrGFHGYM28Z68EYTBLqN822SjTk3Wg1M3js9I-XukM5rLVweTuFrP1UIqHdEafWQaXbGcrDAFsqpu1uGVFturIIDFCd3hnqFkSZ9-OEoCQpIJaTnVc-8zjnS5IA6jhq4AFZEmgVrfq06d7GHKjWP5ozVQiXa8zjRSuTJ8X1OvXcr3r6buJxWBEjO6kr8AjLT-qnEujkLRa0-HQcvnUnpgoL7gOWV_1sCxKOxsj18wGuqisqjB6BNSeXxiEJDsXv46J8JygFYeiS90EI4pKnhoOu_cUO6-NYuUcOrW6p9_Wd0HfmljAEzKlhhNB9jEAujHJztCrLdVBUXQvkQTd_zn1RoNDrU0PubR95J5YgdxoibHBOw32wcAqj0mf1FLfEunH74UYfaASZTj5jg7ZGfM09TrghWPXdRVLZgwE2iG2SfUzKjwSbEvuMMuGYXujjXJ1LZw-t7JoX2A7XSzmmca5bZjOLnlch_1gDRmpXU2K11dxiAMQfMUuhGa5munDLZ3MU3s8OGY3xsmErHFobsSBcUR4W6-QW1OagmrbqOmQhviba4jdPVwnHi8lvkPeV1YlhgR4scujeOaYS-btngkkrZHjD1HQbFgnzdGFmJtbSic-rQiRJGL22jhBXcuACxTa5pDpbOtBKUlauPKdD2sQefe736VGGT2wMH-Wyzg7fZn-HH3Xzg2UGmEsZ_Rv8lJUqiajpZTR3vOLRY_lLzqSUY_9fa1hBfGO-lz50ragDFN2tLVR5Lghlz-blZyvRjZMjeYrmHWs6kGS48BKKMNZhRmrikrFfUx_E6waZiZdGkgWdS4VFqPittajGjbZhHkeSdJsOFPpKGkjHe97SQtq-_3MLpcT2-GUG9kg2N11jpAwlxrAV_SYeTQAQp0NDl-NyjXxKuquJg_yQUEJII8_Vi04Fjvvfp7ohshJuQWDUh7wEwU2KpCZmjI0NlmCNN_tEXKBks86klMmPg5CaV8h_eSUucsKbxO-R3diCXYtpgFm_KLUMoi9bdPNzufryYYYwtMTpRelNPzbifBlSAWVGCULe-zvWF3_12YMn8x6aDmtgbEhQIyKXhCq8duCPes8P11Xxuk0lFVBTcau1qU_NsmAGnMiXYg-DjFh84y3XvcEVe54BihFMlY1zNj5jltYbA4RoxPaG-e1MLCLSuU22U3h37KSMNxFE6tACO1kM--Zf8z375gS80CMLB_V8lt2_T98BNQVuBcxmMLsuSsepyOvBowNuv2ugNOm8rLjkAl3vH7yxAYeAxoenDYz4Alx7FbVbbqG648CW6wRwBjh4LT0hIg13OgxxIvUI88VU37GCYAmNdiMimBxyxaQOyUpAdFg8n6Al1l1pIQrQUmMcboOb7ivkj5nYcYoO_eTHX2LyIMmUDeQ19bzdLFjhySTb5aghYSBdifAZMvX6lO2J9dpiVkwC8DhHGTQ2C9dpkChS6i9SGlhY-oyjQUCsMBUDwtRfCdE6yBcZ1RHWWW8kgu-B9YDRIElMJQ5D28pJzpweHbw7VnpQ4vqAaESmUJ7JUjiHX4EmabOxuzh4xEjelAGKvP8JXHnFg04iAZIvnpVpN1QpxMsBkReYVJu26eBTV9muHV8_NO24eoNGCrRBLgbEwgt3g2TnA9b1-jLpeiP0awCAu74x1TionqQZ2l7_KNKOKZh5EkyVG3nEfwFTm5bil9vfG3W51Z0WyjxnUcAnKbbNjRFF10Qkxw2iJw41SHDq9e9NN9oznu_DzHxyraVB_iIVshkbjDtUHdjeX8UtMLJCU2rja1eCrjLRBLq_pWynCfhgBHhg3LF2Qj1TQ1IrAFTIfOYBErd35ryisNUxvoKa9gQTM5zDYPErzGu-2Sqm4KDc91at46pFNSfrhMMXcAm6T4pD4IhvSZrrOGgNBjB9danMIctlSfqIe8DeAZ3y-vxuAkpAXrRdN-QHg-Xqgcw_pC05WSnf8vdDNCVZ3-HyH49RmjU9P-VLlfXL2Co-xuOGaOa9hubOK0GJFV4piYZCsYyCMwFCBqk_hGtoql9cSkiCT5-ARNrL4OrQTfQZ-DskfmT6hHlBtbzjy1xE-T6SgHmsU1pgiuTjkziFycuKPG27ZqgEbu9RO46IEFh33A-RonZLtXK5FH7XIWd49t6rhJvS56F7q3Fw80-z3n8iBW_9fmstvTrfyXNnTp-hGfbuts0NCWubJnfLjzHag2LKaxw-esgzK0ITb5lU2BOaFO4WJE7KVTvg14DfIqxJ60ZfFhvWkvReDMHGVZbfhbxAppG6JpsIuWLDNw5fmJAauTsZdxVPY8AbLf5EpXIX8X5hQlgQH_EZyDfB__QLyMQ4qzTsvJQik9hyR-s0Lbb6d9_1vM0T-91bmlfmdNRgMm7t7vc3-yGr8IZ9c9YhH2Gn8q6DKlMGTCupXpMrGz6kgbGFnK6n1Lv5XBczolh-GJOmfnNGDIBQuXWunD7EXt9YB3CAvpCzj0mPHJwTqhA1II_JTnhj15EaSg7nvo29SecblVyJHisOkcCD_qLq5_pz0cBEId-hLEpTm8g--sdEji4HFOqqksh_V2A0WDr2oYGQNv9t7nhFVP3XkZBv5l3yJ_sYjZPfUdSDNM_dzDJYmH-41366PqNoYReyar4Zirvy0G12omWu79mjicYnCB0FzAKPtNdZz7_UDXLxUrDA538RdXdV4yl5KoHwZwfbgb6cAfmrmlueLQVtdeFADwCXmKQC9d6A8ZltbDIj-m0NftNZXkWSPPsWpYOQj6W9Raq5SioEcsvwhjP9xr5Ws4IRtASZCar-C_LbnNcRg0Wv0cw7zom_ANpKPTNIwQiBoC_6tdEvui_X_QfcHguukNkQwWygqISzIFs9tG2iEytyhRUPomgCQteYR6ROyZ_hIjj_A2MZ3OAn_jcBIkGBjAEuKzG3N1j92LN9P_FVoTjaI_N6IRa5ySFR3BXtQdMsHtBk0a6QcDXNFtbQSyibmhpjkvTQO2wQz2TAe_cJcKxiGN3eN1vN2_CmphNCvcLAMMuFPgcY&cid=CAQSOwDZpuyz0I7HSycNjniZZLtG-t1hoo9b979uOTJzrOiAua9i6sREkEjxyoUNAV8p6uyQ2bAcJonlTVwqGAE&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=77&iif=1&cor=15429908711735804000&adk=1033480540&idt=675&cac=0&dtd=144

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-18-238-80-126.jfk52.r.cloudfront.net

Software

cafe /

Resource Hash

261a186cd1fc151c1e2b9384debb7d79fbe6c09f9291e9856f6901d16409208e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6888123906427899671
age: 13053
x-content-type-options: nosniff
expires: Thu, 01 May 2025 16:00:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 16:00:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10668
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 18E5 41 KB
14 KB 135ms
131ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2050
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 19:53:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:03:35 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H/1.1

200
OK

view
tpt.mediaplex.com/event/etc/ Frame 18E5
Redirect Chain

https://tpt.dotomi.com/event/etc/view?vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=608441853&audience=&client_campaign_id=32506322&creative_id=231602...
https://tpt.mediaplex.com/event/etc/view?dtm_user_tkn=AQADAoYDgYnsbQJi7PExAQEBAQEBAQCXREDbFAEBAJdEQNsU&vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=6...

43 B
394 B

605ms
310ms

Image
image/gif

2606:ae80:1451:17::1400
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://tpt.mediaplex.com/event/etc/view?dtm_user_tkn=AQADAoYDgYnsbQJi7PExAQEBAQEBAQCXREDbFAEBAJdEQNsU&vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=608441853&audience=&client_campaign_id=32506322&creative_id=231602376&placement_id=415833070&s_id=8617651&site_name=N834879.4729871ADSWERVE-MATTRESS&cachebuster=533274792%22style=%22width:1px;height:1px;display:none;
Requested by: Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: HTTP/1.1
Server: 2606:ae80:1451:17::1400 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-cache, private, max-age=0, no-store
Pragma: no-cache
Connection: keep-alive
Expires: 0
Content-Length: 43
Date: Thu, 17 Apr 2025 19:37:46 GMT
Content-Type: image/gif
Server: nginx

Redirect headers

cache-control: no-cache, private, max-age=0, no-store
location: https://tpt.mediaplex.com/event/etc/view?dtm_user_tkn=AQADAoYDgYnsbQJi7PExAQEBAQEBAQCXREDbFAEBAJdEQNsU&vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=608441853&audience=&client_campaign_id=32506322&creative_id=231602376&placement_id=415833070&s_id=8617651&site_name=N834879.4729871ADSWERVE-MATTRESS&cachebuster=533274792%22style=%22width:1px;height:1px;display:none;
pragma: no-cache
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
server: nginx

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0NDkxODY2NTI3ODA1MQogIHNlcnZlcl9pcDogMTU5OTE5NTI0CiAgcHJvY2Vzc19pZDogMjMxNzU0MDUxMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA4NDI1MTAw...
ad.doubleclick.net/ddm/activity/ Frame 18E5 0
22 B 300ms
158ms Image
image/png 142.250.80.102
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0NDkxODY2NTI3ODA1MQogIHNlcnZlcl9pcDogMTU5OTE5NTI0CiAgcHJvY2Vzc19pZDogMjMxNzU0MDUxMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA4NDI1MTAwCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9tYXR0cmVzc2Zpcm0uY29tIgp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDE1CmV2ZW50X2ltcHJlc3Npb25faWQ6IDExODA0NTYzOTQ4MjcwMjMxODk3CmRlYnVnX2tleTogMTEwNjIwODYzNDU1MDc3MzYxMzAKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI1LTA0LTE3IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODQyNTEwMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fTU9CSUxFX0JST1dTRVJfQ0xBU1MKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTU4MzMwNzAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExNDcwNTA5MDUKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMjIyOTIzNTcyNDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA2NDk5OTU5NDIKICB9Cn0KYXJjaGV0eXBlX2lkOiA5MDkwMjQ3NTIKYXJjaGV0eXBlX2lkOiA5MDkwMjQ3NTMKYXJjaGV0eXBlX2lkOiA5MDkwMjQ3NTQKYXJjaGV0eXBlX2lkOiA5MDkwMjQ3NTUKZmxvb2RsaWdodF9hY3Rpdml0aWVzX2Zvcl9iaWRkaW5nOiA4MjU4MjU3CmZsb29kbGlnaHRfYWN0aXZpdGllc19mb3JfYmlkZGluZzogNzE2OTM2NApmbG9vZGxpZ2h0X2FjdGl2aXRpZXNfZm9yX2JpZGRpbmc6IDcwNjI3NTAKZmxvb2RsaWdodF9hY3Rpdml0aWVzX2Zvcl9iaWRkaW5nOiAxMjE2Nzg5NgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vbWF0dHJlc3NmaXJtLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjEuY29tIgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMi5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3ODA0NzYwODgzMgpkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3CnhmYV9hdHRyaWJ1dGlvbl9hcGlfdHlwZTogWEZBX0FUVFJJQlVUSU9OX0FQSV9UWVBFX1dFQgplY2hvX3NlcnZlcl9hY3Rpb246IEVDSE9fU0VSVkVSX0FDVElPTl9VU0VfQkVTVF9BVkFJTEFCTEVfQVJBCmV2ZW50X3JlcG9ydGluZ193aW5kb3dzIHsKICBlbmRfdGltZXNfc2Vjb25kczogODY0MDAKICBlbmRfdGltZXNfc2Vjb25kczogMzQ1NjAwCn0KbWF4X2V2ZW50X2xldmVsX3JlcG9ydHM6IDIKZmxvb2RsaWdodF9hcmFfY29uZmlncyB7CiAgYXJjaGV0eXBlc19jb25maWcgewogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA5MDkwMjQ3NTIKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDIyCiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAzCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDEKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogOTA5MDI0NzUzCiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAyMwogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMwogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAyCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDkwOTAyNDc1NAogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjQKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDMKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMwogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA5MDkwMjQ3NTUKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDI1CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAzCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDQKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuOTcKICAgIH0KICAgIGltcHJlc3Npb25fYXJjaGV0eXBlcyB7CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAyMgogICAgICBbYWRzLnJlZ2lzdHJhdGlvbl9saWIuQ29tbW9uSW1wcmVzc2lvbkFyY2hldHlwZS5pbXByZXNzaW9uX2FyY2hldHlwZV0gewogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT09LSUVfQ09OU0VOVAogICAgICB9CiAgICB9CiAgICBpbXByZXNzaW9uX2FyY2hldHlwZXMgewogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjMKICAgICAgW2Fkcy5yZWdpc3RyYXRpb25fbGliLkNvbW1vbkltcHJlc3Npb25BcmNoZXR5cGUuaW1wcmVzc2lvbl9hcmNoZXR5cGVdIHsKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogICAgICB9CiAgICB9CiAgICBpbXByZXNzaW9uX2FyY2hldHlwZXMgewogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjQKICAgICAgW2Fkcy5yZWdpc3RyYXRpb25fbGliLkNvbW1vbkltcHJlc3Npb25BcmNoZXR5cGUuaW1wcmVzc2lvbl9hcmNoZXR5cGVdIHsKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogICAgICB9CiAgICB9CiAgICBpbXByZXNzaW9uX2FyY2hldHlwZXMgewogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjUKICAgICAgW2Fkcy5yZWdpc3RyYXRpb25fbGliLkNvbW1vbkltcHJlc3Npb25BcmNoZXR5cGUuaW1wcmVzc2lvbl9hcmNoZXR5cGVdIHsKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9BVVRPX1RBUkdFVElORwogICAgICB9CiAgICB9CiAgICBjb252ZXJzaW9uX2FyY2hldHlwZXMgewogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMwogICAgICBbYWRzLnJlZ2lzdHJhdGlvbl9saWIuQ29tbW9uQ29udmVyc2lvbkFyY2hldHlwZS5jb252ZXJzaW9uX2FyY2hldHlwZV0gewogICAgICAgIGNvbnZlcnNpb25fYXR0cmlidXRlczogQ09OVkVSU0lPTl9ESU1FTlNJT05fQ09OVkVSU0lPTl9EQVRFCiAgICAgICAgY29udmVyc2lvbl9hdHRyaWJ1dGVzOiBDT05WRVJTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0FDVElWSVRZX0lECiAgICAgICAgY29udmVyc2lvbl9hdHRyaWJ1dGVzOiBDT05WRVJTSU9OX0RJTUVOU0lPTl9JU19CSUREQUJMRQogICAgICAgIGNvbnZlcnNpb25fYXR0cmlidXRlczogQ09OVkVSU0lPTl9ESU1FTlNJT05fRFVQTElDQVRFX1JFQVNPTgogICAgICAgIGNvbnZlcnNpb25fYXR0cmlidXRlczogQ09OVkVSU0lPTl9ESU1FTlNJT05fQUdHX1ZBTFVFX0JVQ0tFVAogICAgICB9CiAgICB9CiAgICBtYXhfYXR0cmlidXRpb25zX3Blcl9pbXByZXNzaW9uOiAyMAogIH0KICBzdGFydF9kYXRlOiAyMDI1MDIxOQogIGNvbmZpZ19zdGF0dXM6IFNUQVRVU19PSwp9Cg

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.102 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"909024752":"0xe1534cfebeb61a1c0000000000000000","909024753":"0x7e6d64f6184e236a0000000000000000","909024754":"0x1462a884eef2df570000000000000000"},"debug_key":"11062086345507736130","debug_reporting":true,"destination":["https://mattressfirm.com","https://debugconversiondomain1.com","https://debugconversiondomain2.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["8258257","7169364","7062750","12167896"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["8425100"]},"max_event_level_reports":2,"priority":"0","source_event_id":"11804563948270231897"}
content-type: image/png
server: cafe

GET
H2 200 player Show response
realtime.clinch.co/video/player_v1/ Frame 49E2 11 KB
12 KB 459ms
143ms Document
text/html 18.238.80.126
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://realtime.clinch.co/video/player_v1/player?cid=pfzb1W&caid=77453&format=_160ax600a&dsp=dv360&plcId=22292357240&dsp_impression_id=ABAjH0haMG2a5wwoiUyd4SiIjn6J&dsp_c0=22292357240&site_url=https://paint.toys/oil/&dsp_pub_id=1&site_id=1995081996404&dsp_insertion_order_id=1020511465&dsp_caid=22292357240&dsp_crid=649995942&dsp_tracker_token=AOjeLNEAAABpCmEKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQI-MDphVOoApm3-qIEsALpic_mA0AB0gIqGAAiEwiH14HJ6N-MAxUSmYMIHenaFj4oATABOO3Uu5PaE0ACSAFYiIEgEKbN-LUCdwUPHDOiAMG5pzbvtqJcvw&rnd=1744918663949191&gdpr=0&gdpr_consent=&gdpr_pd=&env=web&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCOLhfh1gBaMf3OZKyjvQP6bXb8APa5dKtfu3Uu5PaE6Gm-PPQHRABIPub1UlgyZ72hoCAoBmgAdKG75opyAEJqAMByAObBKoE7QFP0LrdQLkV0Pv6K5StMBskaLM7fQaJIVXjYiENXrR8-aMxIHrpT6NqM6-OlBVJdYgjpvJKJ4z8o6ngPRDpVnUPXPLAnZJFkzkZCccLIraGv-7TssYslafdtiKhqxAKd5mI-ZKEoJNDsHUbBK6d-T6rk8g3LhCagr_VDv8BGlildqO7vTFCeBDRFO7FdiMFl1EECaenfLUmag1MPGSstJIZeWQJQzcOyyrThXZpjl4lnKPBMzDh-_KBjn8ABZMqvXuLUS-N4PUbkkedaMzPP4IB0WfeuFkFgaKy3B6SiJyDKYscLSD6Ku3bg7z_4t3ABPX9hsmIBeAEA4gF-MDphVOQBgGgBk2AB9K-v_oDqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggnCIBhEAEYHTICigI6DIBAgMCAgICAqIACIEi9_cE6WLSy_8jo34wDgAoDmAsByAsBgAwBqg0CVVPiDRMInOX_yOjfjAMVEpmDCB3p2hY-6g0TCIbYgMno34wDFRKZgwgd6doWPvANAbAT3M__G9gTDdgUAdAVAfgWAYAXAbIXowEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAwshgJEgLMZxhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSOwDZpuyz0I7HSycNjniZZLtG-t1hoo9b979uOTJzrOiAua9i6sREkEjxyoUNAV8p6uyQ2bAcJonlTVwqGAE%26sig%3DAOD64_0VZ0AG6iXA2fVTpKhaOklF4P6_YQ%26client%3Dca-pub-5812357352335075%26dbm_c%3DAKAmf-BL13NXf6HBWFC8kFYsa6umlitdkBZOimXwFIanNnmXOUU8Lul1m04iBTpxaW1qStObshw_VNf38hUWUm8iSOT_WMPF0YHF0LfmiW_LIVEerCViU_dEeKjuN-wBhc9GYbX2SXeV84Z4fOqidYltdc_Dpu5WstHfnZ4IlZxEsW-4Q9yTzsKPf6TyUFMWHem61j5nllphbAnq5pio69vWwZfIcpHhTp714zJCT4rYGlsnsLZA6BSAwgFZw-EG_M7td8lihyG-p43bDpoKoHRBedPbCo7Dfw%26dbm_d%3DAKAmf-BEQn2L1RVctobe4C8HGY76fyxFmCICZVYF0PF3JBzMd2HhSB404_BhucQm1WkZnCca5yxedfVkxOhZJLhxfvwvCEP3qqkSWFX6TEm73StWsGfKPF6tr58kKOgW0P_G9TdAWjeupU7zK2reJahDOmLgRay1RwIlnD6AHtWECLZNOVAmMUV-wJFVFr3v8zzbFhM-8PawvaHKPH81BL9u4NxxtGbamGYKlZ-NVMFyMehXTAjWFwuG5oUqGfh2Za-MtMS1Men2dxNNz344jLrMwJzvr80-iKWwZwY7gvQQ3ecLdM680P7H8sEF3UKwRuOUPU6yVvw0idvishUqkX2VkIEiTEdU8GXiWtT_eaYchC5jPDKXR6kNjvDshXVMvNLJMqIej4IPA2LivZBWQk_w5EK5YoOpMIZknQCymuP0X4nEVyxAKUhrv6flS9FCfGQnbmEf6yZYScLfj6aQq8tVFMGUvDZE1aFGVxbUkDz0RYl2_kjUCfX--2rDGkqKbQkNai79_t7WqWEs9a3a6VJCeiAAIMdDIuyfzupQ_nBfqap_FrvAQ_EOwCU9_7ADs1b3sVtn3FHnJwuQZF_KWDOXaOwii-exMgEr_BHcCURyvKDpz6Ck1fBe3MrHmBzOms7DlxqK9w-zKJ3lTGUZnAmWJ6L8jkYM8L6_FHNEEeJmfGEa9b_eJn0%26adurl%3D

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.80.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

clinch /

Resource Hash

c2d0c2e2a737c5dbaa1976caac6d15778400292aa1ef0ae1223ab5f45e01ae81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:45 GMT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server: clinch
strict-transport-security: max-age=31536000
via: 1.1 0b4bd786c6b93c5bc7d37331a04a3fdc.cloudfront.net (CloudFront)
x-amz-cf-id: u6pP32feKMWPmT_HiNGOrqUEftsDZhHSCDDGEBfiv_x4N4n7gOmheg==
x-amz-cf-pop: JFK52-P5
x-cache: Miss from cloudfront

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame AAB5 1 KB
643 B 132ms
132ms Document
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 5850
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 18:00:15 GMT
etag: 48472445140208031
expires: Fri, 18 Apr 2025 18:00:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18E5 0
0 166ms
165ms Fetch
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18E5 0
0 161ms
159ms Fetch
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 18E5 215 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b2744cbcd1d25e9c21e55570c310aa12124eef3e5afc501cb20b1fe595cd051

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18E5 0
0 159ms
159ms Fetch
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 92B5
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=5455077253969548259

0
770 B

97ms
97ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=5455077253969548259
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=4e171d95-da2d-4ced-8ab4-1d0e59e4ef52&33across.com=v1.0014000001YrMoYAAV.1040.7+hAPPvbbStN6Sq2XGHae6kXNaLN3PdUM5vt/BC5rHvsL+/4oo8aNgASoogNLlSV9HW6mkpTeCTbpg9DC2IlNMrZctkkK41a5Bb16ufBmUg9ymJT1ihgEa0S0Nbfqo0emJCou/RODV4y0dVyuQXG4bGTNO5q0e0W/qRBKwbv5ueEw+efX5Lfa9r2nsphTizIcd/UbI37nWMb2OIz/wJ34EpxiOHJ6zMbo0ljT9Rvq7eQSC0s1/zurqwnr9UhYL8FGJLtpVy9EkomxOsesNaHOQvFy7oxLx1fl1oUr4lrVHdS77OqnuCFQCqz1GcUoHiqydwdFeCjnD9xwpJ5tTaAsleLdIq4nUxxFOs47SlKMw/L65Xw1KjBb0cIoFIwrWZ882c1/Bjq3/bZzHsljLbgKBo7hwgtn4BId0rwT85jKaj7gUjzoJl/dVa3TpqWxBY3hnRoISrpNx3WgnHVeFNB4ymScgfQ+hqyH1tMSoMXnBhV/S9ZLRKIPERH5h6Z0kWkxfN9g8wdThpHBWcY7Y9+0Vag0cJ2MkrNVhldtoL8QWVJMoVPfvq2tI0ug0q3j4LMUSeNaURu4NlGGQtecw4Rgs23glMBlS92hBmySllzo+YZdxesQAKE4AR39gHRjBgtTazCdgJy0djaZ7yotwzXmuxj89RLgEPZVylR74NNt3hdUaLwb1gcGUWUYJcZmtWf/rFx8LKgiX0oc28Kukqe8msGm814LyyyH3L4wHUi7AHFSOrh+IwmKuNxXCH7nWOSh1wUNhoTp4fOHuFqIvcv9/LHoyrmyA6g79Jmp4qf5JWddcmDju915mibWrqmtjcQllF8kultPaFbd86S0hEVoHC2jApC7kW62SaBHNVj21PmJ9LBjKVntHrV15jb+il7UicLNB3a103DFFc3ZH8NTHIq1faY+CsusbVF9Q85vJKSFUw6Gew0pKWGOtWT8jtZuBgIOfeEyYgWJe2xW75x/JCXZMquc3VDISRqokJYbdOFeBYqFHrEKN5LfyILQX9EVBlfSB6niF3/ZGFPsRoqr4kyFRYfY08s9hfZtWzEwDBqFDUmKmLqQfcp2O5dwLiWHS4JW5exYaRPahp1XGn6xeLs/PIUuVzO/4T0s6A+vPOgyr9VPOlcjKxDRmR/pAYJo6P6svwssd43p8rrSz/Dp1qC3whbzSueANwyHCjG4d+u2VY80iIhqsJ1wrwcYHWp1QonfMJaTQ6R6M9P4LzxunAlnM1bAFYaT3GOCzdVgpAolFohmnK0mb7S7q42EkzHf2mRSjBUHbS+y6FnUCnEVCCuYfshzU//RYDwSbwHw+IGcFRKJzC3Nj0yOKQGrmJCqtYmCE4qYasmhp8Zb5blK0LjiONosT9++G5phJb/lCz6HN6UlzMgeakibX+wDoQKksrwZmJ0yEcHFLXkFQWaXKm5F/0ppt+hR8rvyvMqD/c+L5AUoc1bX1h6918+1Jh5+Btp+Uq3lUB3JW8/3JNnYV52a4NGitd0OskzzDF/KNrH2XCoH6+8TELmACAxT7Ug&linkedin.com=6a35b408-9142-4d6d-b03a-03e666b1337e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744918662798&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931e60ffb9cf7d65-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 19:37:46 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=5455077253969548259
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 19:37:46 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

hbpix
idpix.media6degrees.com/orbserv/ Frame AAB5
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_push=AXcoOmRtDZYP8oTOvcaYzXiTVd9Gyw0-3212BC8TMt7dOpiFIKJqLcdCYByBKD0q2ztO6GhYcEkk0O3lRtq0zk2JWz3r-gKEs3k
https://idpix.media6degrees.com/orbserv/hbpix?pixId=69060&pcv=78&ptid=87&tpuv=01&tpu=34d8d62b-50a2-4662-8b5c-c177644e25fd&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dyj...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=yjn0gup
https://idpix.media6degrees.com/orbserv/hbpix?pixId=43286&pcv=60&ptid=87&tpuv=01&tpu=34d8d62b-50a2-4662-8b5c-c177644e25fd

43 B
321 B

159ms
158ms

Image
image/gif

2606:4700:4400::ac40:92d9
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://idpix.media6degrees.com/orbserv/hbpix?pixId=43286&pcv=60&ptid=87&tpuv=01&tpu=34d8d62b-50a2-4662-8b5c-c177644e25fd
Requested by: Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 2606:4700:4400::ac40:92d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931e60ff685a2a86-LAX
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 43
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://idpix.media6degrees.com/orbserv/hbpix?pixId=43286&pcv=60&ptid=87&tpuv=01&tpu=34d8d62b-50a2-4662-8b5c-c177644e25fd
content-length: 273
date: Thu, 17 Apr 2025 19:37:46 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AAB5
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_push=AXcoOmQgXRrJKXhbHB3lCu9RHkwaS6mg1ikJ0VEmpdXfauTdv3hiRbalgGwI7EpoTadw9Y94...
https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_push=AXcoOmQgXRrJKXhbHB3lCu9RHkwaS6mg1ikJ0VEmpdXfauTdv3hiRbalgGwI7EpoTadw9Y94affkiX3B3NrCg2j_up9pKyAvwRQG&google_hm=6KVYvHJCQ9es...

170 B
188 B

151ms
151ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_push=AXcoOmQgXRrJKXhbHB3lCu9RHkwaS6mg1ikJ0VEmpdXfauTdv3hiRbalgGwI7EpoTadw9Y94affkiX3B3NrCg2j_up9pKyAvwRQG&google_hm=6KVYvHJCQ9es5BwbOnrC_g==

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

X-CI-RTID: 9507af89-5242-433f-875c-f639ee028bd4
Location: https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_push=AXcoOmQgXRrJKXhbHB3lCu9RHkwaS6mg1ikJ0VEmpdXfauTdv3hiRbalgGwI7EpoTadw9Y94affkiX3B3NrCg2j_up9pKyAvwRQG&google_hm=6KVYvHJCQ9es5BwbOnrC_g==
Content-Length: 240
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET pm
tr-us.adsmoloco.com/ Frame AAB5 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AAB5
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmQiBbCd45d00zbE3kVNOa7gCakceGKDidIqFm6iZnefOxRUYk9Q_LbyS5GdgPpJ0wcDBkzuVN5uAtVtUCcgjTWzeEapgrTm
https://b1sync.outbrain.com/usersync/googleadx/?google_push=AXcoOmQiBbCd45d00zbE3kVNOa7gCakceGKDidIqFm6iZnefOxRUYk9Q_LbyS5GdgPpJ0wcDBkzuVN5uAtVtUCcgjTWzeEapgrTm&s=2
https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmQiBbCd45d00zbE3kVNOa7gCakceGKDidIqFm6iZnefOxRUYk9Q_LbyS5GdgPpJ0wcDBkzuVN5uAtVtUCcgjTWzeEapgrTm&obuid=b4f0bdf5-1d8b-4615-9959-135c5a0...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQiBbCd45d00zbE3kVNOa7gCakceGKDidIqFm6iZnefOxRUYk9Q_LbyS5GdgPpJ0wcDBkzuVN5uAtVtUCcgjTWzeEapgrTm&google_hm=YjRmMGJkZjUtMWQ4Yi00...

170 B
188 B

149ms
148ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQiBbCd45d00zbE3kVNOa7gCakceGKDidIqFm6iZnefOxRUYk9Q_LbyS5GdgPpJ0wcDBkzuVN5uAtVtUCcgjTWzeEapgrTm&google_hm=YjRmMGJkZjUtMWQ4Yi00NjE1LTk5NTktMTM1YzVhMDA3M2Fh

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:46 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQiBbCd45d00zbE3kVNOa7gCakceGKDidIqFm6iZnefOxRUYk9Q_LbyS5GdgPpJ0wcDBkzuVN5uAtVtUCcgjTWzeEapgrTm&google_hm=YjRmMGJkZjUtMWQ4Yi00NjE1LTk5NTktMTM1YzVhMDA3M2Fh
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 256
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AAB5
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_push=AXcoOmSy_jH8jtnqtDIMo2PuFLIJ6EftRxJ9VdmIGHBlzw...
https://cm.g.doubleclick.net/pixel?google_hm=aAFYiMAoImIAFsfiAYU5RwAACAEAAAIB&google_nid=index&google_push=AXcoOmSy_jH8jtnqtDIMo2PuFLIJ6EftRxJ9VdmIGHBlzw8Nh7OIGZ_UhBhA00qBLvRdbwRMToUEBePdWNH5L9YHCH...

170 B
188 B

153ms
152ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=aAFYiMAoImIAFsfiAYU5RwAACAEAAAIB&google_nid=index&google_push=AXcoOmSy_jH8jtnqtDIMo2PuFLIJ6EftRxJ9VdmIGHBlzw8Nh7OIGZ_UhBhA00qBLvRdbwRMToUEBePdWNH5L9YHCHl7dUti0M-N

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_hm=aAFYiMAoImIAFsfiAYU5RwAACAEAAAIB&google_nid=index&google_push=AXcoOmSy_jH8jtnqtDIMo2PuFLIJ6EftRxJ9VdmIGHBlzw8Nh7OIGZ_UhBhA00qBLvRdbwRMToUEBePdWNH5L9YHCHl7dUti0M-N
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i89hMk%2FVH62NKADVJbJmBfu1%2B5HIcoLSeekvHn0S0538UwoF%2B6%2FNnrtY9xP2fVFYlu96Wcng11iJoun%2Fm9mfzv5dVBzdC%2BVocQWAlZeDrLR%2F1wxf5X6O4QqZgBh5oAHH1V5N8ar%2FkJkrLg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 931e60fc08c4f7ab-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 19:37:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AAB5
Redirect Chain

https://google.partners.tremorhub.com/sync?UIDF=&google_push=AXcoOmSOrpBZNNa_BiybqlxUuBdi6wjopxZrnNlwdRtZBERmdAbcVPvN-7BCPSKkAK2FFVNvEgJksdQC5TKHYkb_S0Lsp41__C5h
https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=ZWUyODQ3ODUxOGRlNGQyMjkzMjY1MzM0MGM4Mjc0N2Y%3D&UIDF=&google_push=AXcoOmSOrpBZNNa_BiybqlxUuBdi6wjopxZrnNlwdRtZBERmdAbcVPvN-7BCPSKkAK2FF...

170 B
188 B

149ms
148ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=ZWUyODQ3ODUxOGRlNGQyMjkzMjY1MzM0MGM4Mjc0N2Y%3D&UIDF=&google_push=AXcoOmSOrpBZNNa_BiybqlxUuBdi6wjopxZrnNlwdRtZBERmdAbcVPvN-7BCPSKkAK2FFVNvEgJksdQC5TKHYkb_S0Lsp41__C5h

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:46 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=ZWUyODQ3ODUxOGRlNGQyMjkzMjY1MzM0MGM4Mjc0N2Y%3D&UIDF=&google_push=AXcoOmSOrpBZNNa_BiybqlxUuBdi6wjopxZrnNlwdRtZBERmdAbcVPvN-7BCPSKkAK2FFVNvEgJksdQC5TKHYkb_S0Lsp41__C5h
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 17 Apr 2025 19:37:45 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AAB5
Redirect Chain

https://cs.media.net/cksync?type=g&google_push=AXcoOmRn-O7FLZUVwR2VUv6qI0bn0r0NyB3IHSYfik_eakVGgzlwky_s8AWNucSKq81p9nU12Kl4PP-sADBqT4aHzv_m5egaXiWY
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mzg3OTIwMjY1MTgyOTM3MDAwMFYxMA%3d%3d&mn_hm=Mzg3OTIwMjY1MTgyOTM3MDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmRn-O7FLZUVwR2VUv6qI0bn0r0...

170 B
188 B

149ms
148ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mzg3OTIwMjY1MTgyOTM3MDAwMFYxMA%3d%3d&mn_hm=Mzg3OTIwMjY1MTgyOTM3MDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmRn-O7FLZUVwR2VUv6qI0bn0r0NyB3IHSYfik_eakVGgzlwky_s8AWNucSKq81p9nU12Kl4PP-sADBqT4aHzv_m5egaXiWY&gdpr=&gdpr_consent=

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:46 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mzg3OTIwMjY1MTgyOTM3MDAwMFYxMA%3d%3d&mn_hm=Mzg3OTIwMjY1MTgyOTM3MDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmRn-O7FLZUVwR2VUv6qI0bn0r0NyB3IHSYfik_eakVGgzlwky_s8AWNucSKq81p9nU12Kl4PP-sADBqT4aHzv_m5egaXiWY&gdpr=&gdpr_consent=
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 17 Apr 2025 19:37:45 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: text/html
Server: Apache

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame AAB5 0
12 B 147ms
146ms Image
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LlmwPnKByR96q3q1mb1zUimnE7h1u6KlkRwhpwZoMvoB9GC9-o0VEDnmT-S58YAU6Lg5aY

Requested by

Host: 1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com
URL: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 409B 38 KB
13 KB 132ms
132ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1e204a31a84bea16b83bd865f2a697c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1734
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 19:08:51 GMT
expires: Thu, 17 Apr 2025 19:58:51 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 4A27 1 KB
2 KB 134ms
134ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 969875d3eb92180b3798faf84e6cc9c10a29dbb5ed2666ef8f169180192d449d

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1186
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 19:37:45 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

setuid
prebid.intergient.com/ Frame 3E39
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY&us_privacy=1NNY&khaos=M9LRIP5I-22-5F5M
https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9LRIP5I-22-5F5M&us_privacy=1NNY

0
987 B

156ms
155ms

Image
text/html

104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9LRIP5I-22-5F5M&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744918666&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=I6zJAfaOfZ7MOFvwo2%2Bznjk%2BoiRhEAYLcNpGB%2BaFM8Y%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744918666&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=I6zJAfaOfZ7MOFvwo2%2Bznjk%2BoiRhEAYLcNpGB%2BaFM8Y%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 931e60ff6b817c5f-LAX
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9LRIP5I-22-5F5M&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
content-length: 0
Content-Type: text/html

GET
H3 200 DPdAcMMWjrlhTr6yATjpq-RSGOddA_iHYEDsDNEXX-E.js Show response
pagead2.googlesyndication.com/bg/ Frame 409B 54 KB
20 KB 132ms
131ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/DPdAcMMWjrlhTr6yATjpq-RSGOddA_iHYEDsDNEXX-E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-154-76.compute-1.amazonaws.com

Software

sffe /

Resource Hash

0cf74070c3168eb9614ebeb20138e9abe45218e75d03f8876040ec0cd1175fe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 192360
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Wed, 15 Apr 2026 14:11:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Apr 2025 14:11:45 GMT
last-modified: Mon, 07 Apr 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20958
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 7E43 7 B
1 KB 126ms
126ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=M9LRIP5I-22-5F5M
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 4A27
Redirect Chain

https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=7255&xuid=AABdM07QArEAABvbZ0JeYQ&dongle=bzwx&gdpr=0

37 B
475 B

138ms
138ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7255&xuid=AABdM07QArEAABvbZ0JeYQ&dongle=bzwx&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://eb2.3lift.com/xuid?mid=7255&xuid=AABdM07QArEAABvbZ0JeYQ&dongle=bzwx&gdpr=0
Content-Length: 0
Date: Thu, 17 Apr 2025 19:37:45 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 4A27 43 B
168 B 131ms
129ms Image
image/gif 34.224.236.221
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=20&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.236.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-236-221.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 4A27 43 B
168 B 134ms
129ms Image
image/gif 34.224.236.221
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=114&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.236.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-236-221.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 4A27
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://eb2.3lift.com/xuid?mid=3702&xuid=${ADELPHIC_CUID}&dongle=d54f&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3702&xuid=e8a558bc-7242-43d7-ace4-1c1b3a7ac2fe&dongle=d54f&gdpr=0&gdpr_consent=

37 B
475 B

139ms
139ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3702&xuid=e8a558bc-7242-43d7-ace4-1c1b3a7ac2fe&dongle=d54f&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif

Redirect headers

X-CI-RTID: 5ad07472-f1c5-4473-b035-6ac2f025aa3e
Location: https://eb2.3lift.com/xuid?mid=3702&xuid=e8a558bc-7242-43d7-ace4-1c1b3a7ac2fe&dongle=d54f&gdpr=0&gdpr_consent=
Content-Length: 149
Date: Thu, 17 Apr 2025 19:37:45 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 4A27
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=83&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&partner_url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3646%26xuid%3Dac01...
https://eb2.3lift.com/xuid?mid=3646&xuid=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&dongle=1fa5&gdpr=0&gdpr_consent=

37 B
475 B

142ms
136ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3646&xuid=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&dongle=1fa5&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=3646&xuid=ac01a2d2-23fa-4a5b-84c2-002ba7443c8a-68015889-5553&dongle=1fa5&gdpr=0&gdpr_consent=
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 17 Apr 2025 19:37:46 GMT
server: Jetty(11.0.25)

GET
H2

200

xuid
eb2.3lift.com/ Frame 4A27
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=445028429856779291474&gdpr=0&gdpr_consent=${GDPR_CONSENT}
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=50572fa4-dfec-4f39-b562-b8b7695c2ca9&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=9b4cf887-c463-40dc-a7c4-3d5a5b7ed263&ssp=triplelift&expires=30&user_group=5&bsw_param=50572fa4-dfec-4f39-b562-b8b7695c2ca9
https://eb2.3lift.com/xuid?mid=2409&xuid=50572fa4-dfec-4f39-b562-b8b7695c2ca9&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
475 B

136ms
136ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=50572fa4-dfec-4f39-b562-b8b7695c2ca9&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //eb2.3lift.com/xuid?mid=2409&xuid=50572fa4-dfec-4f39-b562-b8b7695c2ca9&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 19:37:46 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 4A27
Redirect Chain

https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=4771&xuid=4334320726214499808&dongle=d407&gdpr=0&gdpr_consent=

37 B
475 B

140ms
139ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=4771&xuid=4334320726214499808&dongle=d407&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://eb2.3lift.com/xuid?mid=4771&xuid=4334320726214499808&dongle=d407&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 19:37:41 GMT

GET 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame 4A27 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame 4A27
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://b1sync.outbrain.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&s=2
https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&obuid=6ba96250-4f72-40b1-ac40-1f0aa7132d2d&s=2
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=6ba96250-4f72-40b1-ac40-1f0aa7132d2d&gdpr=0

37 B
475 B

139ms
138ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=6ba96250-4f72-40b1-ac40-1f0aa7132d2d&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=6ba96250-4f72-40b1-ac40-1f0aa7132d2d&gdpr=0
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 131
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 4A27
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=522DC5776C58492BA1E56DE1EC48DC3F&dongle=yf3

37 B
475 B

137ms
136ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=522DC5776C58492BA1E56DE1EC48DC3F&dongle=yf3
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 19:37:46 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://eb2.3lift.com/xuid?mid=7969&xuid=522DC5776C58492BA1E56DE1EC48DC3F&dongle=yf3
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 16 Apr 2025 19:37:45 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 200 setuid
prebid.intergient.com/ Frame 4A27 0
902 B 156ms
154ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=445028429856779291474
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744918665&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=3yAVeQbOeJR7MtPLQc23Czx8nzry%2F%2FzP%2Bpp%2BPxshBRc%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744918665&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=3yAVeQbOeJR7MtPLQc23Czx8nzry%2F%2FzP%2Bpp%2BPxshBRc%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 931e60fd79b57c5f-LAX
server: cloudflare

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 3E39 43 B
855 B 393ms
135ms Image
image/gif 98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: TWE2AMRCS18R66MQRS1Q
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 17 Apr 2025 19:37:46 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3E39
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/Ui5juelyplydlYFtH74ggcn5EUdSAgOZEtemQ7w0kco?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-_siK7tlE2oKRoUZSByu6KhQt1cK7Fh66KpHvFg--~A

42 B
1 KB

206ms
123ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-_siK7tlE2oKRoUZSByu6KhQt1cK7Fh66KpHvFg--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 82a6cabd8b3f0d2d2ae6e86e2699f0ba
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-_siK7tlE2oKRoUZSByu6KhQt1cK7Fh66KpHvFg--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 17 Apr 2025 19:37:46 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 3E39
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9LRIP5I-22-5F5M&us_privacy=1NNY

0
146 B

113ms
113ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9LRIP5I-22-5F5M&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 8B04B720FF8B4497AF70D7F9ACC0FFE2 Ref B: LAX311000115031 Ref C: 2025-04-17T19:37:46Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYy/olCsSXf5NHIGGDqJg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 19:37:45 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9LRIP5I-22-5F5M&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Pragma: no-cache
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E39
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDRiNDJiODQyY2Y5OTNhNDE4ZmJmYTNhMGMwNmYxYWYzYTVjZjJhNQ&us_privacy=1NNY

170 B
188 B

149ms
148ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDRiNDJiODQyY2Y5OTNhNDE4ZmJmYTNhMGMwNmYxYWYzYTVjZjJhNQ&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-154-76.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:46 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDRiNDJiODQyY2Y5OTNhNDE4ZmJmYTNhMGMwNmYxYWYzYTVjZjJhNQ&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 8bab65602db075726861004da5629947
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 3E39
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=M9LRIP5I-22-5F5M&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

157ms
138ms

Image
image/gif

98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=M9LRIP5I-22-5F5M&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 541P7NDFGYMWMN8A8REP
Content-Length: 43
Date: Thu, 17 Apr 2025 19:37:46 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=M9LRIP5I-22-5F5M&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
content-length: 0
Content-Type: text/html

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 3E39 70 B
501 B 98ms
94ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-length: 70
date: Thu, 17 Apr 2025 19:37:45 GMT
content-type: image/gif
server: Kestrel

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 3E39 43 B
855 B 715ms
287ms Image
image/gif 54.239.33.158
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.239.33.158 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 8742RVRJ7HWT508E35G5
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 17 Apr 2025 19:37:46 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 3E39 170 B
188 B 148ms
147ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 19:37:45 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E39
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlMUklQNUktMjItNUY1TQ==&us_privacy=1NNY

170 B
188 B

153ms
152ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlMUklQNUktMjItNUY1TQ==&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS