paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.dmcgrathbuilding.com/bhmrtomqvvubcsxnvkvnatbqpgiarkRRFE0WFI1MG9yTnBYRXhQNDZ0bTctMjYyMC0yNjc1OTA0Ny0wZmNhMDI3My0zNjg1LUFqazBhb0ttSmh5RDk2VnJXYXBM/2rm4qo18jg4v50e3mp4qfachxzarhi7eq/wgerny/81yeipxlsxw5c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 67373
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1632
content-type: text/html; charset=UTF-8
date: Thu, 17 Apr 2025 22:32:55 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JS2Y4DFR07KZBZSJRY5TRJ3V

Redirect headers

accept-ranges: bytes
age: 6560
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1665
content-type: text/html; charset=UTF-8
date: Thu, 17 Apr 2025 22:32:54 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JS2Y4DDFJ10T76CH2JKM6NSW

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 302ms
140ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6ca2e6e84ef3961cac081f7595487d640d41b7da20901fba36e713129eb9233

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 931f61917ad808ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 221ms
219ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 26694
accept-ranges: bytes
content-length: 1391
x-nf-request-id: 01JS2Y4DJC7YJF0CEDTS773BJ6
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 213ms
211ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 6560
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JS2Y4DJCQFTEKPBRAQMPKSW7
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 142ms
141ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 36019
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JS2Y4DJC5ZCZP4SRGZV3YY0T
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 71ms
70ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 26694
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JS2Y4DJC2WQNGDMPT2ZB93WS
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 73ms
70ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 26694
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JS2Y4DS9NFG3VME44HVCWQ38
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 79ms
78ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 26694
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JS2Y4DSCPK7G25Y0Y8FJY9Y2
cache-status: "Netlify Edge"; hit
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 174ms
172ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2855e7d8a21782c659e20b31a577d7182c1ef14819ac98ef0345462de9f5abf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 931f6191db7708ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
123 KB 389ms
138ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e380b04516d87060282a76e3b952f64ff31d5a0d1512bb53ddad31301ed0acc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 22:32:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 125539
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 50530363469658c9e05ec319ddb4f65523e19cefff8e789f.v1.js Show response
faucetfoot.com/files/ 68 KB
25 KB 316ms
99ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/files/50530363469658c9e05ec319ddb4f65523e19cefff8e789f.v1.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

93c0747a6829abbd691af9ee321ee905e4f6cc38e2e578d7cd9cea0fce5c5a89

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"6f9b4c89b1dfc37a44e4b3735bcc5c47b504370d1f6b3bbaeb6ddc48ed642156"
via: fen-hoothoot-us-west1-9vjq.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
34 KB 430ms
142ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6cb03456b74ee80fe4cc9b46269574b0eef0afa5d91eb7e908e162faec83486b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 894 / 20195 / m202504140101 / config-hash: 6116971411016617479
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:32:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34037
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 95ms
94ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 85
cf-ray: 931f6192fc7808ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 411 B
363 B 77ms
76ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b35367386570f17ff5be2b4d3f5a9ef2816b7947869005cfae73ec88dcba460

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"038af8099c70ce8099f11e60671651ea"
age: 5810
cf-ray: 931f6192fc7a08ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.f78d8905f1617efa83f4.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 130ms
129ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aed279b0a29e774ca22dafc6a078e7582490608c9d18bda1a138ca55d0d5be9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f1a6e4325cdcf59d711cbdc9bbf9de8f"
age: 772
cf-ray: 931f61937cf208ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.f49d9d120d738f961843.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 461 KB
140 KB 130ms
130ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad7d0d55c693f50a025e443da2f37eaea32dad37cbfe918cde1717f8f33af733

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"2da544a46407e9f6f4d2fc5d5058f814"
age: 774
cf-ray: 931f61937cf808ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:55 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 539ms
134ms Image
image/gif 2600:9000:25c8:7e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=ad_300x250_6724608
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25c8:7e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 104752
x-cache: Hit from cloudfront
x-amz-cf-id: jwaj_4ewqoOx1k218msHDJ66mNsS-kuvcOMGmG3w-06naoTKPrYb4A==
date: Wed, 16 Apr 2025 17:27:04 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 0d7b07b36f46ce1652b97dbb50107674.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: PHL51-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 314 KB
109 KB 142ms
140ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130495~103130497

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8fcb5c69661f62da1ac0a1f08ed2a5c8bad4334d79b5ed7b48a8417c8fed5376

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 22:32:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 111586
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 401ms
141ms Fetch
text/plain 2607:f8b0:4004:c1f::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54g3v9101576445za200&_p=1744929175109&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130495~103130497&cid=1361009009.1744929176&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744929176&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1765
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1f::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 559 B
467 B 78ms
77ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 771
cf-ray: 931f6197291608ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 238A 503 B
427 B 299ms
96ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 772
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 931f61992d2e2ac1-LAX
content-encoding: br
content-type: text/html
date: Thu, 17 Apr 2025 22:32:56 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 164E 503 B
0 299ms
299ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 772
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 931f61992d2e2ac1-LAX
content-encoding: br
content-type: text/html
date: Thu, 17 Apr 2025 22:32:56 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/18/desktop/Chrome/ 585 B
922 B 575ms
143ms XHR
application/json 2600:9000:215f:1a00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/18/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:1a00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c46973772dbb723b9754d3a2fd728c3deea69a4a7e842f65cf8192faab88f067

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 1924
via: 1.1 0df778cadb5eaa000de4f1d7838b16e0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 585
x-amz-cf-id: 7AyNu_KTfJsl7ULzXqwbO6NqjwTuGx_WgWVt6r4uHJbDs6mMv3nxlQ==
date: Thu, 17 Apr 2025 22:00:52 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 149 KB
39 KB 253ms
77ms Script
application/javascript 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db3b4c65b9b7c658c43074b51473188ca8efe46a669c6801234e3267be15168a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "c270076359905b3d723a15d71336e6a6"
via: 1.1 google
cf-ray: 931f61987bca2f03-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39507
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: application/javascript
last-modified: Thu, 17 Apr 2025 22:04:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.12d39b3042a89bfe935d.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 75ms
74ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/ccpa.12d39b3042a89bfe935d.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 109c88771b4dd248e3dca670efe895b5aaefb0ee49e1cca776b2640717a933ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"206627f4662eb69e99a3cb421866652c"
age: 773
cf-ray: 931f6197695208ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 357 KB
86 KB 1136ms
139ms Script
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8d079b3855248fcdd0eb891569d2c669c4df9d09e81270f254e37280b51e274a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"8eb33601d7a1e0448ae3ae6845bc11ff"
age: 2903
via: 1.1 e2cb9339c523d170f53dc64537b22e10.cloudfront.net (CloudFront), 1.1 bdfa5ff45a012f4d008a55b929c33ce2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 3rsRq_SvqPPbIGjtQRREejqdUNPYIaKkBbHETz-Jn6OeHPbb21D2MA==
date: Thu, 17 Apr 2025 21:44:35 GMT
content-type: application/javascript
last-modified: Tue, 15 Apr 2025 20:03:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, IAD89-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
591 B 677ms
210ms Image
image/gif 2606:50c0:8003::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 8909f45e35675c0c068f338c6a32af7a749ab7cb
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: A8FF:7A21E:1027F3F:122A9DF:67ECEDD1
expires: Thu, 17 Apr 2025 22:37:56 GMT
x-cache: HIT
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: image/gif
x-served-by: cache-toj-leto2350048-TOJ
x-cache-hits: 3
source-age: 106
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1744929177.763956,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/ 526 KB
166 KB 124ms
124ms Script
text/javascript 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c27459ed32e1691ca416d75eb8d91e9224853ed48456eed838caad0c9d0fd2bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 15152493403001972295
age: 7247
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 20:32:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 20:32:09 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169679
x-xss-protection: 0
server: cafe

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 412ms
135ms Script
text/javascript 3.167.69.97
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-97.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 55836
via: 1.1 c297f40f50ed0c04a618a50b8a9423fe.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: cOiyh9Xr5z6CKAw7lV9pBPv5hOkrspObgqBOaE88B3cZUvnEB9RRmQ==
date: Thu, 17 Apr 2025 07:02:21 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 195ms
143ms Fetch
text/plain 2607:f8b0:4004:c1f::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54g3v9102396898za200zb9101576445&_p=1744929175109&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026~103130498~103130500&cid=1361009009.1744929176&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744929176&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1744929175109&tfd=2138
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130495~103130497
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1f::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/ 64 KB
23 KB 131ms
130ms Other
text/plain 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

e4a1f6bb4df43a4e3aded46465e55b8749b64817d13ed9557075c596d218c340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5790688912801242087
age: 30710
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 14:01:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 14:01:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23384
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504170101"

POST
H3 200 2c8d442b00ef386919739429db543975e7c7e7ef7775f8e2a09344a3 Show response
faucetfoot.com/confirm/3139e42564/ 295 B
319 B 177ms
99ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/confirm/3139e42564/2c8d442b00ef386919739429db543975e7c7e7ef7775f8e2a09344a3

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/files/50530363469658c9e05ec319ddb4f65523e19cefff8e789f.v1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

aa25364451ca504f36ea4d97de6523940da65f10eeeb5b7d4e5e0088e6557a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-9vjq.gce-us-west1, 1.1 google
expires: Thu, 17 Apr 2025 22:32:55 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 238A 17 KB
7 KB 83ms
82ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 773
cf-ray: 931f6199de0b2ac1-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 164E 17 KB
0 76ms
76ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 773
cf-ray: 931f6199de0b2ac1-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 201 KB
65 KB 512ms
178ms Script
application/javascript 2607:f8b0:4004:c0b::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8b32212bc3b80c1a46fcb08a8fc891ae421a6d545ee1d7a2959153a7a37acf38

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nEXGlx_xg8KLC16pD96Y5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmII0pBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYjj0m6ypgFx796brDeO3GQV4uaY2dx2gE3gx-QpIUoaSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRfFGBkamBiaGZnoGhvEFBgBAxDMJ"
content-security-policy: script-src 'report-sample' 'nonce-nEXGlx_xg8KLC16pD96Y5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET f93864a9-0428-4579-8f65-d1d40e1dec39
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 412ms
119ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 22:32:56 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 200916
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 208ms
81ms XHR
application/json 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 71964
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744857212&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=zyyVBKOePlfDo2PkpxUyMPq%2FW7ZaqHzgR%2F%2FFm8ghLtQ%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Thu, 17 Apr 2025 02:33:32 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744857212&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=zyyVBKOePlfDo2PkpxUyMPq%2FW7ZaqHzgR%2F%2FFm8ghLtQ%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 931f619b9d757d1b-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
1 KB 79ms
78ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 2822
cf-ray: 931f619acd1308ee-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:08 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 458ms
124ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/bhmrtomqvvubcsxnvkvnatbqpgiarkRRFE0WFI1MG9yTnBYRXhQNDZ0bTctMjYyMC0yNjc1OTA0Ny0wZmNhMDI3My0zNjg1LUFqazBhb0ttSmh5RDk2VnJXYXBM/2rm4qo18jg4v50e3mp4qfachxzarhi7eq/wgerny/81yeipxlsxw5c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e61437bc91869b0a662ae205e9d64a9dbb0d5f25f2fe85007d5867e110dfea7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 446 KB
141 KB 485ms
172ms Script
text/javascript 2607:f8b0:4004:c19::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd157b223b1750cc055c61f89e92980c4bf01073ceca11ae087780f86eb5ff63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16482565349839558474
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:32:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144243
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 681ms
218ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-158-52-71.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
775 B 440ms
132ms Fetch
application/json 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: d8affa35245e55ed522628954caa6ecb77ed28d8d5f98043c7a4459a4379e2bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
682 B 483ms
126ms Fetch
application/javascript 34.232.220.61
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.220.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-220-61.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 5b1b51525f51a98db32b53abad5eda4fa10128c12f55196618f69e2f6f73acec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 289ms
118ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 1d2ed074048b9ab474f8645eff2363be7c909873929cad43d395df42f5c31c31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 17 Apr 2025 22:32:56 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 520 B
932 B 428ms
130ms Fetch
text/plain 54.158.52.71
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js2y4f5xnsfmr6b4zzafgpnm&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.158.52.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

946eb951c1c1a19b169a2d0f1016cd5e23e1a01a15be3132a85423e14046eaf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 693c2ad334b885fe
request-time: 6
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 22:32:57 GMT
access-control-allow-origin: https://paint.toys
content-length: 520
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=smPt_HxmNFVWV1VDTVY2ZVpWTHAzYUt5eFJ4T1JtSFhXVWVPd3FzRXlRcEFNWFIvaEdQZUhySnNQRjcxeDJNS1VxMXQ4TGRWaSt6akIyR1hGL0xPN3gzTEFodlVhek9SOHhaNFJRNVRNMWdXK0pYendXYytvQTg5R0pMMT...

365 B
927 B

365ms
121ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=smPt_HxmNFVWV1VDTVY2ZVpWTHAzYUt5eFJ4T1JtSFhXVWVPd3FzRXlRcEFNWFIvaEdQZUhySnNQRjcxeDJNS1VxMXQ4TGRWaSt6akIyR1hGL0xPN3gzTEFodlVhek9SOHhaNFJRNVRNMWdXK0pYendXYytvQTg5R0pMMTIvdkFuZnVVazY1VUtOcDlmREQ5UDNWTFo4QVJNb1BKSTQ3THFqNUw4OXpMMHVkY09DcWJZbmx2akFhODVuVk9sc2owajk3eVEvbEduZXBYMFFrc3p6UEJWOEVsNUVWRWhtRlJpa0t5Z2tIbnh0dFlmQndiOWFrMDZEUTl5T2Q1ZGdRV0tQeXBqfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

57ae8275fd2d7d82c491b320b94d9fd97a35dfcd0aadfa00512667b7283a20a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 452158
expires: 0
access-control-allow-origin: null
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=smPt_HxmNFVWV1VDTVY2ZVpWTHAzYUt5eFJ4T1JtSFhXVWVPd3FzRXlRcEFNWFIvaEdQZUhySnNQRjcxeDJNS1VxMXQ4TGRWaSt6akIyR1hGL0xPN3gzTEFodlVhek9SOHhaNFJRNVRNMWdXK0pYendXYytvQTg5R0pMMTIvdkFuZnVVazY1VUtOcDlmREQ5UDNWTFo4QVJNb1BKSTQ3THFqNUw4OXpMMHVkY09DcWJZbmx2akFhODVuVk9sc2owajk3eVEvbEduZXBYMFFrc3p6UEJWOEVsNUVWRWhtRlJpa0t5Z2tIbnh0dFlmQndiOWFrMDZEUTl5T2Q1ZGdRV0tQeXBqfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 270278
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 17 Apr 2025 22:32:57 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_2c33cb6d-9cc0-4784-add9-53eb6ceca61d_1744929176685
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfMmMzM2NiNmQtOWNjMC00Nzg0LWFkZDktNTNlYjZjZWNhNjFkXzE3NDQ5MjkxNzY2ODUQABoNCJmDhsAGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=c277698cb1597260eb0333deca6138a456bb842a387fa11ddf136dde4c4e03c1791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c277698cb1597260eb0333deca6138a456bb842a387fa11ddf136dde4c4e03c1791426b5417dce21&rand=00100613
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c277698cb1597260eb0333deca6138a456bb842a387fa11ddf136dde4c4e03c1791426b5417dce21&rand=00100613&expected_cookie=e48624ad-9a51-46dc-852f-5f53170c9fa4

0
144 B

151ms
150ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c277698cb1597260eb0333deca6138a456bb842a387fa11ddf136dde4c4e03c1791426b5417dce21&rand=00100613&expected_cookie=e48624ad-9a51-46dc-852f-5f53170c9fa4
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E46BD0E3213040FFAD783C414670E1D1 Ref B: LAX311000115007 Ref C: 2025-04-17T22:32:57Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzAPvPCtr91QufENgSFA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 22:32:57 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: /db_sync?pid=10339&puuid=c277698cb1597260eb0333deca6138a456bb842a387fa11ddf136dde4c4e03c1791426b5417dce21&rand=00100613&expected_cookie=e48624ad-9a51-46dc-852f-5f53170c9fa4
x-msedge-ref: Ref A: 2B30E111C72343498441C035AF048B49 Ref B: LAX311000115007 Ref C: 2025-04-17T22:32:57Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzAPvMhZYj0+9fK+SgTg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 22:32:57 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_2c33cb6d-9cc0-4784-add9-53eb6ceca61d_1744929176685
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_2c33cb6d-9cc0-4784-add9-53eb6ceca61d_1744929176685

1 KB
2 KB

125ms
124ms

Script
application/javascript

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_2c33cb6d-9cc0-4784-add9-53eb6ceca61d_1744929176685
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: fac61c4e705fe434dbabccbca5951e8abc167b0a7e7b7be26c80c895266249f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 22:32:57 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_2c33cb6d-9cc0-4784-add9-53eb6ceca61d_1744929176685
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 22:32:57 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 458ms
140ms XHR
application/json 44.220.104.194
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.220.104.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-220-104-194.compute-1.amazonaws.com
Software: /
Resource Hash: 0d8356098c93b9b5acfba449dcfcbf9457903d30d352f6dce71393899d4cf687

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json;charset=utf-8

GET
H2 200 init-a.js
dl.edge-aicdn.net/assets/ 0
0 258ms
83ms Fetch
text/javascript 2606:4700:20::681a:ab8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://dl.edge-aicdn.net/assets/init-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ab8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 816644
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qUYuiqP%2BK8wERxO4DWNV0lyd2ZdFvCKKGkyqR7veLtFAPMe1wJpWULoECfSEXsx6B8zXHSl8a0qYU63022fQYPKFi9Mni1fRXFD5z9BubwfAem7Le8BUCN8u5dWvmkyyhoWAe64FdtZIjIpPI0HR"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 08 Apr 2025 12:41:18 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=59959&min_rtt=59683&rtt_var=13045&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3797&recv_bytes=2203&delivery_rate=63939&cwnd=252&unsent_bytes=0&cid=adba0355db4d6de5&ts=93&x=0"
x-goog-stored-content-length: 0
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:38:53 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItesXpewPkh3PVY937gliQHvMmcijA3GPuaT77G9JBAsbvjNCh5I27xQNwCrR3XBlJF
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 931f619eac012f35-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743183533533707
content-length: 0
server: cloudflare

GET
H2 200 config-a.js
storage.ml-cachehost.net/lib/ 0
0 212ms
75ms Fetch
text/javascript 2606:4700:20::ac43:4488
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://storage.ml-cachehost.net/lib/config-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4488 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 490294
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kPToV6cP9DPyB7C0UQ6m2MLz%2BD3DYpY16IgV7qoppg0xvYCFNGEL%2Bx627A15vfKM5fhSY%2BQJOBCm6K%2B9invkXk8hrXvE6DrRj3x5CqyJQJF73Z%2F3vE8fVH4erDiOC0mCOTujNn7ad6FdCgAw%2BIQ3F%2FUFo2MP8w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Sat, 12 Apr 2025 06:51:19 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=60321&min_rtt=60172&rtt_var=12934&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3852&recv_bytes=2215&delivery_rate=64008&cwnd=252&unsent_bytes=0&cid=5b6c19b45bcf5fb9&ts=84&x=0"
x-goog-stored-content-length: 0
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:51:11 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIs4sN3hJIqt_b1oTFGgd_PbZD_XaRCaRDAX0wAr0U_XABLtxFfBYUYmx5pPcSKRqzi_
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 931f619e6bcf08f4-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743184271495855
content-length: 0
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 251ms
76ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8293
x-goog-stored-content-encoding: identity
expires: Fri, 18 Apr 2025 22:32:57 GMT
x-goog-stored-content-length: 43
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 931f619ea8387d0f-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 294ms
122ms Image
image/x-icon 142.251.16.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 58478
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 06:18:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 06:18:19 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
567 B 247ms
73ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9344467050725743
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8293
x-goog-stored-content-encoding: identity
expires: Fri, 18 Apr 2025 22:32:57 GMT
x-goog-stored-content-length: 43
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 931f619ea8327d0f-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1744929177272&did=did-0046&se=e30&duid=8e413bd09c43--01js2y4f5xnsfmr6b4zzafgpnm&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgr...
https://rp4.liadm.com/j?dtstmp=1744929177272&did=did-0046&se=e30&duid=8e413bd09c43--01js2y4f5xnsfmr6b4zzafgpnm&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcg...

13 B
369 B

461ms
125ms

Fetch
application/json

34.235.53.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1744929177272&did=did-0046&se=e30&duid=8e413bd09c43--01js2y4f5xnsfmr6b4zzafgpnm&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 34.235.53.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-53-196.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: b128dd00-cb3a-43c6-8174-b915c8976af4
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1744929177272&did=did-0046&se=e30&duid=8e413bd09c43--01js2y4f5xnsfmr6b4zzafgpnm&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo2
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 17 Apr 2025 22:32:57 GMT

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 457ms
125ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 412ms
124ms XHR
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 433ms
165ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&bid=1e2n4ou

70 B
440 B

123ms
123ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 22:32:57 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&bid=1e2n4ou
content-length: 191
date: Thu, 17 Apr 2025 22:32:57 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MjVwQ185enJjM2ZVWnJzQXNoaU5ONmtUcVNZWGNDVE5xSWxiOTk0cVBrUVE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MjVwQ185enJjM2ZVWnJzQXNoaU5ONmtUcVNZWGNDVE5xSWxiOTk0cVBrUVE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

124ms
122ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 22:32:58 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Thu, 17 Apr 2025 22:32:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-JY7Vh4JE2pW6HrBuwjT64L7mrtXGR7G2o4A-~A&gdpr=0

70 B
440 B

338ms
123ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-JY7Vh4JE2pW6HrBuwjT64L7mrtXGR7G2o4A-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 22:32:58 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-JY7Vh4JE2pW6HrBuwjT64L7mrtXGR7G2o4A-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8613648871061682592&newuser=1&referrer_pid=m51mh00

70 B
440 B

230ms
124ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8613648871061682592&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 22:32:58 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8613648871061682592&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 22:32:47 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=8603902614458982697&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

250ms
125ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=8603902614458982697&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 17 Apr 2025 22:32:58 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=8603902614458982697&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.247; 162.245.206.247; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7a16ace3-fa52-4299-ae61-0f6f8a1d4268
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 22:32:57 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 670ms
216ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

1fd87175b6ea58f5e37928f5430552316319a3883f8fd13afa0d5ead6fb69270

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 AGSKWxVhCgVYePh974Tg10-3CN3m3cos8NM6eSTJcNHmIhJIh40_uKPKSoT3bTqmzJVB6ZmwUPLkzHuaIlxqgpxZ6wy0XY6DwPQI10Xl8zFZ0YM1b98dgJfFbfR3fyIbSngFxCaHmVkfOA== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 163ms
162ms Script
application/javascript 2607:f8b0:4004:c0b::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVhCgVYePh974Tg10-3CN3m3cos8NM6eSTJcNHmIhJIh40_uKPKSoT3bTqmzJVB6ZmwUPLkzHuaIlxqgpxZ6wy0XY6DwPQI10Xl8zFZ0YM1b98dgJfFbfR3fyIbSngFxCaHmVkfOA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTI5MTc3LDUxNjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ6WkdTRnhoQy16SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmRtY2dyYXRoYnVpbGRpbmcuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

82edea427b129bd284dd331fffb6526455f4a23158c5e985e238ab7aaeacea5b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-INvfdBZWM8g-w39XUuv8Eg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmLw0JBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYjj0m6ypgFx796brDeO3GQV4uGY2dx2gE3gxu61i5iUNJLyC-OT8_NKijKTSkvyi9KS01KLU4vKUovijQyMTA1MDM30DAzjCwwAdE0zcQ"
content-security-policy: script-src 'report-sample' 'nonce-INvfdBZWM8g-w39XUuv8Eg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 507E 101 KB
28 KB 366ms
122ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

sffe /

Resource Hash

af8c669f941e754271c71ba5714ac0e5247ce6c3d1b1638257e1b2862d33beaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1778
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28941
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 22:03:19 GMT
expires: Thu, 17 Apr 2025 22:53:19 GMT
last-modified: Mon, 14 Apr 2025 19:44:10 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 509ms
140ms Script
application/javascript 2600:9000:269f:aa00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:269f:aa00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 2100
x-cache: Hit from cloudfront
x-amz-cf-id: DBSlDhGYHw9iF0Afk76RzqAqen93qPJ7ZlTYXTreLlbeKrDfCkGLAg==
date: Thu, 17 Apr 2025 21:57:58 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 0880eac0689b5b1cff547e39e0daa976.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: YUL62-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 278ms
62ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 198063
x-goog-stored-content-encoding: gzip
expires: Wed, 15 Apr 2026 15:31:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 15 Apr 2025 15:31:54 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyItIUbTZ9gJzw53fy34N30mENeJLMNCCyMCkzVlwDjNzWvvg2EyjGztrDlmBBHR9QwwJ
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 397ms
221ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 432f36fa27c75a689860c1da73686fa9

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 262ms
76ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 445621
cf-ray: 931f61a12e47792b-LAX
expires: Sun, 20 Apr 2025 22:32:57 GMT
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 490ms
239ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 18 Apr 2025 22:32:58 GMT
access-control-allow-origin: *
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 363ms
121ms XHR
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 37969
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: 6THecS6Wrl9OURGeZsb3LQ2Sw0g_-RMK-ER6csqIODpjGbImLC1R6A==
date: Thu, 17 Apr 2025 12:00:09 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 a035f6df76b0fcf3f3f167c837fad7ee.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 383ms
119ms Script
application/javascript 18.160.10.101
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-101.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1612
via: 1.1 1f1067e4f193aaabd2c24b99bcdc4e88.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: 8JObr28NZjto1302QUvoDe7g1oMdfRKVyNLMV280ZDqZ2pEpMYjuTQ==
date: Thu, 17 Apr 2025 22:06:06 GMT
content-type: application/javascript
x-amz-cf-pop: IAD12-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 124ms
124ms XHR
application/json 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 5150
access-control-allow-credentials: true
via: 1.1 bdfa5ff45a012f4d008a55b929c33ce2.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: 9Q59yxauiu9775-eZffU1NN5jjyLgAOGzzY6VfIcm44IL-fZ3hCevQ==
date: Thu, 17 Apr 2025 21:07:07 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD89-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
373 B 573ms
225ms Fetch
application/json 108.138.68.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&pid=rQ8tAkVM7ywJZ&cb=0&ws=1600x1200&v=25.409.1848&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=fda298a4-c969-470d-b338-825b72278d7d&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D&vm=%7B%22vendors%22%3A%7B%22liveintent%22%3A%7B%22data%22%3A%7B%22default%22%3A%7B%22user%22%3A%7B%22ext%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22liveintent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2213-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D%22%2C%22atype%22%3A3%7D%5D%7D%2C%7B%22source%22%3A%22bidswitch.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2270ec3ebb-e7fc-4bca-806c-7e53a8efe06c%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22openx.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2254b91979-23f5-4565-b16f-b33a236f2354%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22rubiconproject.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22M6VCOCYF-1C-3A8E%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22media.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%223782028751764519000V10%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22pubmatic.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22226BB3C0-C127-40F1-A3C8-BC72609FF0FB%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22liveintent.indexexchange.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22Z6Xs1kt3udIAIoduAOzTIAAA%261278%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22liveintent.triplelift.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%221075601553087813430040%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22sharethrough.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228b234260-d68a-4af4-ab4c-a948d554f6b0%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22liveintent.sonobi.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%224f760ed7-11dc-432d-b807-aaec2eb8dfa1%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%5D%7D%7D%7D%7D%7D%7D%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.68.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-68-124.iad12.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 be186fed299dda1ccfe93db37fe3b3fa.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: 9LlqTIi0cmx0xo_GtzwpvkfusHw6UdROiyPDmq76hmc6jqFiReAUNA==
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD12-P1
server: Server

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 366ms
119ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 22:32:57 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 192532
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 ima_ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 67 B
59 B 135ms
134ms XHR
application/json 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fpaint.toys%2Foil%2F

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

641768f2d1d19839fc3cecfa5158382fa0d332d5e49e31bcaafbedc4af91995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:32:57 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 35
date: Thu, 17 Apr 2025 22:32:57 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame D654 2 KB
1 KB 413ms
119ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=97715
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 17 Apr 2025 22:32:58 GMT
expires: Sat, 19 Apr 2025 01:41:33 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 042C 1 KB
2 KB 234ms
62ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1708
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:04:29 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwqfBv527JSPIiPoHRFY02CXWY2-ca_bLxYqFWabyk4zQBCfdXN15oY78BAaMA9xtpzxcHRQjBw

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 320ms
149ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09f26442151c25eda7b7ef0ef8c5fef7677c5f2c2c3c54c70cd1e6ddeb197a04

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744929177&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=IJfYUFXLPjwyRDvvOeDpv64G4D0AMvqVPoCeZE7AMEc%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744929177&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=IJfYUFXLPjwyRDvvOeDpv64G4D0AMvqVPoCeZE7AMEc%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 931f61a1c9677650-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 423 B
1 KB 842ms
671ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f942dd09e54e75fdd2cc8013ea46feb6e02fee6b3c72c18512ca1157e1f68a55

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744929178&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=9N7wot6bKA5chq%2BcWtHh8TYt7gBOna86WA825LnpMXU%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744929178&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=9N7wot6bKA5chq%2BcWtHh8TYt7gBOna86WA825LnpMXU%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 931f61a1c9647650-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 409ms
136ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=93446776197&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:57 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 13 KB
6 KB 614ms
288ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=1075601553087813430040%5E3%5E%5E%5E%5E%5E&eid_media.net=3782028751764519000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M6VCOCYF-1C-3A8E%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA%261278%5E3%5E%5E%5E%5E%5E&eid_openx.net=54b91979-23f5-4565-b16f-b33a236f2354%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=b802cbb6-a5aa-43fc-a25c-f9ed9cf09c17&l_pb_bid_id=68a593a03fef7d1&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=0e3d2e78-2fe5-4018-a99f-3d746eada182&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.9474694407141995
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 46560eda28e3a45482d59d913410fb9e56f0e02a22fb4d43ea4095f13f993265

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 13 KB
6 KB 692ms
366ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=1075601553087813430040%5E3%5E%5E%5E%5E%5E&eid_media.net=3782028751764519000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M6VCOCYF-1C-3A8E%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA%261278%5E3%5E%5E%5E%5E%5E&eid_openx.net=54b91979-23f5-4565-b16f-b33a236f2354%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=b802cbb6-a5aa-43fc-a25c-f9ed9cf09c17&l_pb_bid_id=69d3832ea5d4673&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=3cf5777c-e17c-4cf1-8d34-73b5bd2cad7b&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.5047088398142409
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: fe19771729708855da54e7974e63896ed6f57e02b71759fb1407b363d16bbdd3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
882 B 558ms
233ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=1075601553087813430040%5E3%5E%5E%5E%5E%5E&eid_media.net=3782028751764519000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M6VCOCYF-1C-3A8E%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA%261278%5E3%5E%5E%5E%5E%5E&eid_openx.net=54b91979-23f5-4565-b16f-b33a236f2354%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=b802cbb6-a5aa-43fc-a25c-f9ed9cf09c17&l_pb_bid_id=7016e874c1f182c8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=6889ac42-9c0f-4719-b815-a8a741537092&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.23043588235329882
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 935f9796b9f3920c729b201ddf55b477840c7bca560e760ce66965b84c4f3751

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
1 KB 449ms
124ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=1075601553087813430040%5E3%5E%5E%5E%5E%5E&eid_media.net=3782028751764519000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M6VCOCYF-1C-3A8E%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA%261278%5E3%5E%5E%5E%5E%5E&eid_openx.net=54b91979-23f5-4565-b16f-b33a236f2354%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=b802cbb6-a5aa-43fc-a25c-f9ed9cf09c17&l_pb_bid_id=711cff31b32812c8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=9971c266-f28c-43bf-bda9-2c3fd637398a&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.37117575332424857
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 5a86ba8ef08fbb010ffbe7f4827d8c210cf73721431f3f956ed4c162c6d52a7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
625 B 600ms
265ms Fetch
application/json 54.192.51.76
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-76.yul62.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 72944426e54c95e7bd371b055450af5ead804dbe7bb915d6589b1e96be6382cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 37504d411c7d230cb5e53aaf2809b804.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: JJkqsE3OQdHuszoUSYHOuiMX6rkBemiKkxmKnT6Wts5AAtcFI8mQfA==
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
708 B 149ms
129ms Fetch
application/json 68.67.160.114
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.114 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.247; 162.245.206.247; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: ab4590af-c8b6-45a2-858c-ae454936aee2
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 22:32:57 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 269ms
96ms Fetch
text/plain 35.186.253.211
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 6ca5404aa90a067db358e16a058beca7b96d92a491bb7fc88ec9b75af91380b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.247
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/plain
vary: Origin

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 722ms
399ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 22:32:58 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 630ms
309ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 22:32:58 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 626ms
308ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 22:32:58 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 641ms
322ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 17 Apr 2025 22:32:58 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
769 B 572ms
245ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 457ms
136ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 400ms
123ms Fetch
application/json 52.206.149.189
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744929177718&to=600&aun=pw-160x600_atf&pubcid=994661b9-79d8-4e7e-b969-337709db6e7b&fabrickId=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33acrossId=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&lipb=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=0e3d2e78-2fe5-4018-a99f-3d746eada182&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=7731&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.149.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-149-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 400ms
124ms Fetch
application/json 52.206.149.189
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744929177719&to=600&aun=pw-160x600_btf&pubcid=994661b9-79d8-4e7e-b969-337709db6e7b&fabrickId=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33acrossId=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&lipb=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=3cf5777c-e17c-4cf1-8d34-73b5bd2cad7b&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=7731&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.149.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-149-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 401ms
125ms Fetch
application/json 52.206.149.189
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744929177719&to=600&aun=leaderboard_atf&pubcid=994661b9-79d8-4e7e-b969-337709db6e7b&fabrickId=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33acrossId=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&lipb=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=6889ac42-9c0f-4719-b815-a8a741537092&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=7731&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.149.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-149-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 401ms
125ms Fetch
application/json 52.206.149.189
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744929177719&to=600&aun=leaderboard_btf&pubcid=994661b9-79d8-4e7e-b969-337709db6e7b&fabrickId=E1%3ADOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33acrossId=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ%2FacDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5%2F3xjaN7DxSFV4woesoHh%2B1VheY%2BNbd%2BPLdT92jXMzuHwO%2Bi11lggBrftBIWk5xnZu%2BcHxCKBGJxjbrgiRD1bJqIv%2FYdchLbjfYyBe0mkvq%2FfF8wVjRIuPy2mScNnm2e1N%2B2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY%2FpFN%2Bh8JrXAvdUqzMo8PkECyQne2t%2BHbUdlTT8DWCdgMHnEWX%2BHiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY%2FkxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF%2BNamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa%2FgSDAfg819dZT%2F59T82ho8%2BJn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn%2BvsWEwipMYdhWA%2FSWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD%2B2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF%2B1LFwvVdtN2ITEQHXgpKp%2B%2Fg6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf%2BtyPRbF7pO%2FinkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX%2BmzocMX%2BO0Qn6IqG12y16phMyPqpYGrUscm%2BfQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG%2BKrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ%2BCezqgT%2Fo%2BXFBL6vnIpwP3REVonvk7OJUbeqOxzf%2BKar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS%2B4C%2FGt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6%2B11W%2FPUNmco8NjAdmBoSbqHHWFpJL%2FXeit6tkG1C67z22eZsu%2FYjERd1P13cOpvVqBOupEereCOZoo2bduJ75S%2BOvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ%2B8UuT2%2FF1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j%2FSmcbcU8k%2FGQSpFITA89eDIjMMw5OUh9LF%2F11LAE%2BsFzsiKDS0ALiH5y4uT%2FBIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&lipb=13-3whu%2FzqPFbjZmcrjWUTuRmm9Hs49AkbGc%2BkQdqu5E9jXvR6ld0VfO19sMvsAex46%2FFtjbyxEi8tkXdh%2FQZKt%2FC8xWWWXM8ObJznKCWZTiYcLJQ%3D%3D&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=9971c266-f28c-43bf-bda9-2c3fd637398a&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=7731&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.149.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-149-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 611ms
260ms Fetch 54.209.245.63
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.209.245.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 484ms
133ms Fetch 54.209.245.63
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.209.245.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 599ms
249ms Fetch 54.209.245.63
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.209.245.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 602ms
252ms Fetch 54.209.245.63
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.209.245.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 25 B
312 B 564ms
258ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

717c0fbc1bc78c7fd1c1a6cc1eda65cf9017f228359a458a1b45b2f89c9e2697

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 39 B
667 B 291ms
146ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2e3b5b882c9739a3fab9b08d5061925cb5322f25d751765d97c4ffb7afbf76f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FSib2bhQ1ULchzJ0E65tlJzEUgBm6Y6hIE%2B03mSlbnu3tJaX8asabvV2VqgF7%2BrrFjNuIEp%2Bmjz1ybEpeaKKYj17u8B6UR%2FqpT400%2BHzq8tvKdSnvF89cZ6xfTXM4STJfhn5FZx1"}],"group":"cf-nel","max_age":604800}
cf-ray: 931f61a1e9956f97-LAX
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 39
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 34 B
320 B 591ms
271ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: afc2a1e79262e3323bb7c1dd7879fe3317a4e2242d2c45869c16644d6eed59b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:32:58 GMT
server: nginx

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 145 B
996 B 382ms
239ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62e124c367cb3ccf6a7fe1086ee75fb44b4741455d3e99c581a9a69bb7adfd7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 931f61a1ec0b69cd-LAX
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 438ms
126ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/bhmrtomqvvubcsxnvkvnatbqpgiarkRRFE0WFI1MG9yTnBYRXhQNDZ0bTctMjYyMC0yNjc1OTA0Ny0wZmNhMDI3My0zNjg1LUFqazBhb0ttSmh5RDk2VnJXYXBM/2rm4qo18jg4v50e3mp4qfachxzarhi7eq/wgerny/81yeipxlsxw5c
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 17 Apr 2025 22:47:58 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 17 Apr 2025 22:32:58 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 144ms
141ms Script
text/javascript 3.167.69.97
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/bhmrtomqvvubcsxnvkvnatbqpgiarkRRFE0WFI1MG9yTnBYRXhQNDZ0bTctMjYyMC0yNjc1OTA0Ny0wZmNhMDI3My0zNjg1LUFqazBhb0ttSmh5RDk2VnJXYXBM/2rm4qo18jg4v50e3mp4qfachxzarhi7eq/wgerny/81yeipxlsxw5c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-97.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 53980
via: 1.1 c297f40f50ed0c04a618a50b8a9423fe.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 7b73eXai9UMOEp08V-LjPb65OCYAJ4J1wv1UV1TqWW_oGIa4_jqPCQ==
date: Thu, 17 Apr 2025 07:33:18 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 219ms
70ms Script
text/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/bhmrtomqvvubcsxnvkvnatbqpgiarkRRFE0WFI1MG9yTnBYRXhQNDZ0bTctMjYyMC0yNjc1OTA0Ny0wZmNhMDI3My0zNjg1LUFqazBhb0ttSmh5RDk2VnJXYXBM/2rm4qo18jg4v50e3mp4qfachxzarhi7eq/wgerny/81yeipxlsxw5c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 6931
cf-ray: 931f61a37aeec798-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Tue, 22 Apr 2025 22:32:58 GMT
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 268ms
92ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50e007518d200ae11214757387229dbd045c72df7a6180821e460442a605565a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"5ad11df110aef21f5b862d37fdc34379"
age: 3271
expires: Thu, 17 Apr 2025 23:32:58 GMT
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 02 Apr 2025 08:25:26 GMT
vary: Accept-Encoding
x-amz-id-2: d5gHHgaZRPqTvlmcFB5C/xZHMn01peIqC5aUQzaL0PtZb2X3kYunxjRAKAOYZVFclXnmA/yKocIlKwyw9nfL9Eyck5HuVYAT
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: R8S04N5C7A9H0AB6
cf-ray: 931f61a3e93f0f19-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 443ms
243ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/bhmrtomqvvubcsxnvkvnatbqpgiarkRRFE0WFI1MG9yTnBYRXhQNDZ0bTctMjYyMC0yNjc1OTA0Ny0wZmNhMDI3My0zNjg1LUFqazBhb0ttSmh5RDk2VnJXYXBM/2rm4qo18jg4v50e3mp4qfachxzarhi7eq/wgerny/81yeipxlsxw5c
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 17 Apr 2025 22:47:58 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 17 Apr 2025 22:32:58 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 AGSKWxWq_U3IRTMHJOeoA756sb0j42F5uWKqypwsB2CjNePnUJIEVAk4J5FNOderRcPM_7Kcqjd5gFJTqMavfdvSdSqSkDItO1Yf7FIrLfV6JSqmhiHGPwT1Tojg--lXvYUUTybeaQUDag== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 149ms
148ms Script
application/javascript 2607:f8b0:4004:c0b::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWq_U3IRTMHJOeoA756sb0j42F5uWKqypwsB2CjNePnUJIEVAk4J5FNOderRcPM_7Kcqjd5gFJTqMavfdvSdSqSkDItO1Yf7FIrLfV6JSqmhiHGPwT1Tojg--lXvYUUTybeaQUDag==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTI5MTc3LDc1NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwielpHU0Z4aEMtekkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXd4ei5kbWNncmF0aGJ1aWxkaW5nLmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6fdd66caf39daba25c17517f4f4206aaeb4a31643b21314a8be43f8d893c2d95

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-plnYetKzG4z4ls_PbO0C_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmII0JBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYjj0m6ypgFx796brDeO3GQV4uGY2dx2gE3gw_qOCcxKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgYmhmZ6BobxBQYAcP8zTw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-plnYetKzG4z4ls_PbO0C_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 200 2c8d442b00ef386919739429db543975e7c7e7ef7775f8e2a09344a3
faucetfoot.com/3539e42564/ 2 B
25 B 162ms
91ms Ping
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/3539e42564/2c8d442b00ef386919739429db543975e7c7e7ef7775f8e2a09344a3

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/files/50530363469658c9e05ec319ddb4f65523e19cefff8e789f.v1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-9vjq.gce-us-west1, 1.1 google
expires: Thu, 17 Apr 2025 22:32:56 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
550 B 406ms
218ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: f13475e9ce528f5c7f87ac5b51f72a2c117f1db95b2f645b4c4cadafa55d3de4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 285
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
x-cloud-trace-context: 893d186a7c39f6f048a500f5a4fa47cd
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame E9F4 4 KB
5 KB 422ms
130ms Document
text/html 198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 228bb59d337256420edaf0fd125516e75a1bb1d192d8890b2edf46a2a7f9e4bb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4239
content-type: text/html
date: Thu, 17 Apr 2025 22:32:58 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 852 B
1 KB 219ms
219ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

b22b8c1ffa7033aee87b01226ef7e8e5aadf1b84371d6d670307c8a4c34d99c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: Origin

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 306ms
77ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6192d7b9a03dc98c0490251dfd8f4f7b767bfb4c2726977fc3019a6635bdf342

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 109
cross-origin-resource-policy: cross-origin
cf-ray: 931f61a65ca1cdfb-LAX
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 17 Apr 2025 22:25:31 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
277 B 80ms
79ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5681669b6c38a9ce7b23041f051945a7eefccafd61bcbaa2efe27a41862d58e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 931f61a68a920f19-LAX
access-control-allow-origin: *
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 249ms
85ms Preflight
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 931f61a5f8c00f19-LAX
content-length: 0
content-type: text/plain
date: Thu, 17 Apr 2025 22:32:58 GMT
expires: Fri, 17 Apr 2026 22:32:58 GMT
server: cloudflare

GET
H3 200 setuid
prebid.intergient.com/ Frame E9F4 0
832 B 216ms
152ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=0cfffc3c-7ba1-14f0-69b2-b717928f8e27
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744929178&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=9N7wot6bKA5chq%2BcWtHh8TYt7gBOna86WA825LnpMXU%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744929178&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=9N7wot6bKA5chq%2BcWtHh8TYt7gBOna86WA825LnpMXU%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 931f61a5e831f0e2-LAX
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=8603902614458982697&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

206ms
133ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_consent...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

131ms
130ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

185ms
143ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privac...
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=1438841359497018154665&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

174ms
130ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&sovrn_retr...
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

197ms
129ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%...
https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDdDMjk5OEYtOTU3MC00OTQ3LUI4NDYtMzNFNEUzMEI0MUQ1&gdpr=-1&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=-1&gdpr_consent=&google_error=15
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

137ms
134ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 178
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=8de6a02b-7528-495b-ba02-b44b2e2676e5
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

165ms
129ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-6c649ca7-b066-476a-8034-31b602d8eda6
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

182ms
129ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=40677dd931ddf48442c133ebe7d436a&_fw_gdpr=&_fw_gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

147ms
128ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kg3oALZHWpD709A0RvOp1TbQ&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame E9F4
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3879307791829548000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

213ms
129ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT

GET
H/1.1 200
OK sync.html
sync.clearnview.com/ Frame E9F4 734 B
734 B 442ms
128ms Image
text/html 204.62.12.186
NATCOWEB

General

Check archive.org

Download Go to Show image

Full URL: https://sync.clearnview.com/sync.html?gdpr=&gdpr_consent=&usp_consent=1NNY&pubid=17&pubuid=0cfffc3c-7ba1-14f0-69b2-b717928f8e27&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dbrave%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D$UID
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.62.12.186 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

Transfer-Encoding: chunked
Access-Control-Allow-Origin: https://sync.cootlogix.com
Keep-Alive: timeout=5
Date: Thu, 17 Apr 2025 22:33:00 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 204 pbsync
ads.yieldmo.com/ Frame E9F4 0
42 B 423ms
122ms Image
text/plain 44.193.100.245
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/pbsync?is=vidazoo&gdpr=&gdpr_consent=&us_privacy=1NNY&redirectUri=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dyieldmo%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%24UID
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.193.100.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-193-100-245.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame ACB5
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

1032ms
702ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 17 Apr 2025 22:32:59 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 22:32:58 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 82D7 199 B
425 B 259ms
86ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Thu, 17 Apr 2025 22:32:57 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.247

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 2CFC 0
573 B 377ms
124ms Document
text/html 2600:9000:27cb:7a00:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fuser%3FpartnerId%3Dminutemedia%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BpartnerId%7D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:7a00:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://sync.cootlogix.com/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Thu, 17 Apr 2025 22:32:58 GMT
server: istio-envoy
via: 1.1 6ae27853e1d5d9f5ac45bdd63df3f096.cloudfront.net (CloudFront)
x-amz-cf-id: DIyoJ7D1uqvhT1etqjrVEBDPpgC8gVzLay6XsNbjHIzHulmBIPa86w==
x-amz-cf-pop: IAD55-P6
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 118ms
117ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 17 Apr 2025 22:47:58 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 17 Apr 2025 22:32:58 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
3 KB 497ms
496ms Fetch
text/plain 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=234086611683209&correlator=1965136680209897&eid=31090594%2C95332150%2C83321254%2C31091204&output=ldjh&gdfp_req=1&vrg=202504140101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1744929178566&lmt=1744929178&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1KmdrNUFyTlF2aUdpS3lKczd1amN1UTMwX3h0NEhCQjhhMmUwSml3b2l1QThQUVFVNlE4TEtZM19LNnBoT05ZNC1YARI0CgpwdWJjaWQub3JnEiQ5OTQ2NjFiOS03OWQ4LTRlN2UtYjk2OS0zMzc3MDlkYjZlN2JYARI_ChxsaXZlaW50ZW50LmluZGV4ZXhjaGFuZ2UuY29tEh1aNlhzMWt0M3VkSUFJb2R1QU96VElBQUEmMTI3OFgBEjcKDWJpZHN3aXRjaC5uZXQSJDcwZWMzZWJiLWU3ZmMtNGJjYS04MDZjLTdlNTNhOGVmZTA2Y1gBEjYKDHB1Ym1hdGljLmNvbRIkMjI2QkIzQzAtQzEyNy00MEYxLUEzQzgtQkM3MjYwOUZGMEZCWAESKAoScnViaWNvbnByb2plY3QuY29tEhBNNlZDT0NZRi0xQy0zQThFWAESHQoOZXNwLmNyaXRlby5jb20Ytv-Ir-QySABSAghkEhgKCXlhaG9vLmNvbRi8g4mv5DJIAFICCG8SFAoFb3BlbngY2YGJr-QySABSAghvEhsKDDMzYWNyb3NzLmNvbRi1_4iv5DJIAFICCGQSggIKCHJ0YmhvdXNlEuwBRkl0UGZlbisrOWpMNU5xOWhYZkJFc056ZEpmc3ZlS2pkd1lHK2p4TFhudUtpM05nWFk3Y1RLaUZjU2dFRXk5a3ZTNjBnUUU1akpTcG0rbFdFZkFOWjF3Mm9xeHNMOG1YTVp1UklxYzUyMllnaEVFN2J2MnJzZDNnS2hGRHlTa0VLYkR1K1pVdW1Cb3dMZ3Q1eDA0eC9nakRWRUYxRCs3VytYNUV0WEJJZEl2dVl1REl2anVZK3NKaVkyOVBkSFlmT0hKNDRRd2FLSjZ1c3BEQ1ErUFZXQkNqejRsZnJaZUFSN3hHbTRIRzZWdz0Y8YWJr-QySAASMwoJb3BlbngubmV0EiQ1NGI5MTk3OS0yM2Y1LTQ1NjUtYjE2Zi1iMzNhMjM2ZjIzNTRYARKHAQoObGl2ZWludGVudC5jb20SczEzLTN3aHUvenFQRmJqWm1jcmpXVVR1Um1tOUhzNDlBa2JHYytrUWRxdTVFOWpYdlI2bGQwVmZPMTlzTXZzQWV4NDYvRnRqYnl4RWk4dGtYZGgvUVpLdC9DOHhXV1dYTThPYkp6bktDV1pUaVljTEpRPT1YARI1ChlsaXZlaW50ZW50LnRyaXBsZWxpZnQuY29tEhYxMDc1NjAxNTUzMDg3ODEzNDMwMDQwWAE.&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1744929175078&idt=1620&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Dae6d8d95d5944e71ada66710b488e5ce29177565%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_format_rubicon%3Dbanner%26hb_size_rubicon%3D160x600%26hb_pb_rubicon%3D0.95%26hb_adid_rubicon%3D133de7531ce9f2958%26hb_bidder_rubicon%3Drubicon%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.95%26hb_adid%3D133de7531ce9f2958%26hb_bidder%3Drubicon%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e1%26cc-intent-id%3D469762048%252C218890240%26cc-iab-class-id%3D482%252C283%26cc-iab-name%3DShopping.Children%27s%2520Games%2520and%2520Toys%252CHome%2520%2526%2520Garden.Interior%2520Decorating%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.dmcgrathbuilding.com%252F%26tyche_code%3DV.20250415.1%26pageos_code%3DV.20250415.1%26config_id%3D1024872_74068_primary_config%26hour%3D12%26day%3DThursday%26referrer_domain%3Dqwxz.dmcgrathbuilding.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250415.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=59802&tan=8bcb44fc-0eb6-4e70-b93d-aad6a637448b&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed65f0f7cfb6e6055efd2e451ce0669d75f67bc22ac5070c49ec1a919b8b8684

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 5979979807
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138445370349
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 2991
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
0b4674ca694ff883afaeeab1d0896870.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame D522 7 KB
3 KB 416ms
134ms Document
text/html 142.251.167.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://0b4674ca694ff883afaeeab1d0896870.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 22:32:58 GMT
expires: Thu, 17 Apr 2025 22:32:58 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 afcsearchads. Show response
fundingchoicesmessages.google.com/f/AGSKWxWOBFseO2H0l-u_TCgPf-vhtkTXsBHn61L7VCJA5SKDDQFHWP3BCz1NfKLS0t9l075YEmadxxPKioPtMTJgR8_dL1PrXe1oMXDfIyYe0EHDqdCDqkitXzb0_CdLmaC6VLjtTnQbRbDBr7dw9ANvXS37zBBmn... 54 B
109 B 142ms
140ms Script
application/javascript 172.253.63.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWOBFseO2H0l-u_TCgPf-vhtkTXsBHn61L7VCJA5SKDDQFHWP3BCz1NfKLS0t9l075YEmadxxPKioPtMTJgR8_dL1PrXe1oMXDfIyYe0EHDqdCDqkitXzb0_CdLmaC6VLjtTnQbRbDBr7dw9ANvXS37zBBmnu8T6wLePnvY-jLAKihkZOEK_RA8CcBd/_/slafc.js/realmedia_banner./pilot_ad./doubleclick.js/afcsearchads.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0e4d643639e15f389b5dd27d50bf762269c7fc56825432c0b1099fdca1404fc0

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-2YxqNdxXDuJbS3DS7827PQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmLw1ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYjj0m6ypgFx796brDeO3GQV4uGY1dx2gE3gwLej-5iUNJLyC-OT8_NKijKTSkvyi9KS01KLU4vKUovijQyMTA1MDM30DAzjCwwAhigzzg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-2YxqNdxXDuJbS3DS7827PQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 40 KB
15 KB 373ms
122ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a52b20d2085190770a667af47b8a6914b254e9e39a822de7ef5901d93e54a2fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8160924690237668766
age: 2717
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:47:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 21:47:41 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 15021
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxVmYH-rrXda8bUocw-sIs_bwgb2UysSaBA9ahHmFmANjUm12mFnReUpwP5mg0j-k9xwKm-YNa1u-v5Cp7ZlJId-wgPsReHTMSKQOR7NWY5X_DPvJ_10dZjS2T20RtP7f7G66bovFQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 270ms
138ms XHR
text/html 172.253.63.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVmYH-rrXda8bUocw-sIs_bwgb2UysSaBA9ahHmFmANjUm12mFnReUpwP5mg0j-k9xwKm-YNa1u-v5Cp7ZlJId-wgPsReHTMSKQOR7NWY5X_DPvJ_10dZjS2T20RtP7f7G66bovFQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kjjf7mAVBm5yFnCtA6S_HQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0pBi-FB_mfUHEAvxcMxqbjvAJnDi3tw_TEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAAZlkkiw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kjjf7mAVBm5yFnCtA6S_HQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 517ms
131ms XHR
application/json 2606:ae80:1471:1a::1460
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:1a::1460 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 17 Apr 2025 23:02:59 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/json
vary: Origin
server: nginx

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVmYH-rrXda8bUocw-sIs_bwgb2UysSaBA9ahHmFmANjUm12mFnReUpwP5mg0j-k9xwKm-YNa1u-v5Cp7ZlJId-wgPsReHTMSKQOR7NWY5X_DPvJ_10dZjS2T20RtP7f7G66bovFQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--9f5f7AFop9oizgyQgZosA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAvxcMxqbjvAJnDjxvImZiWXpPzC-OT8vJLUvBLdxJRiXRC7KDOptCS_CIWdWgZSkZOfnp6Zlx5vZGBkamBiaKZnYBZfYAAASD4kIQ"
content-security-policy: script-src 'report-sample' 'nonce--9f5f7AFop9oizgyQgZosA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 222ms
221ms Fetch
text/plain 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 215ms
215ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

1fd87175b6ea58f5e37928f5430552316319a3883f8fd13afa0d5ead6fb69270

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 233ms
86ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e3f84b2a779d78921849c67d98e91ee507be4fe504fc609bb4293bce0e5910e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 281
cf-ray: 931f61a8ca4bdb59-LAX
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 17 Apr 2025 22:24:15 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
170 B 312ms
112ms Image
image/gif 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&halo_id=060ixedju6a65cehcjl6gelekjl9ef8ehdfuomkwi0e0yimsiw00qm0myw06mo4ms
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61a91e08db72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 304ms
96ms Image
text/html 52.35.244.50
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.35.244.50 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-35-244-50.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&adnxs_id=8603902614458982697&gdpr=0

43 B
95 B

123ms
122ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&adnxs_id=8603902614458982697&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61aa983bdb72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&adnxs_id=8603902614458982697&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.247; 162.245.206.247; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 997891d4-16bc-49ac-9080-71afa17db334
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001744929179-D1UNVUFT-D8TL%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001744929179-D1UNVUFT-D8TL%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=f24ce610-7e4f-452e-91a2-151cabb62093&id=AU1D-0100-001744929179-D1UNVUFT-D8TL&auid=AU1D-0100-001744929179-D1UNVUFT-D8TL

43 B
95 B

140ms
139ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=f24ce610-7e4f-452e-91a2-151cabb62093&id=AU1D-0100-001744929179-D1UNVUFT-D8TL&auid=AU1D-0100-001744929179-D1UNVUFT-D8TL
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61a9ef2bdb72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=f24ce610-7e4f-452e-91a2-151cabb62093&id=AU1D-0100-001744929179-D1UNVUFT-D8TL&auid=AU1D-0100-001744929179-D1UNVUFT-D8TL
pragma: no-cache
x-forwarded-for: 162.245.206.247
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001744929179-D1UNVUFT-D8TL
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001744929179-D1UNVUFT-D8TL
https://ids.ad.gt/api/v1/pbm_match?pbm=07C2998F-9570-4947-B846-33E4E30B41D5&id=AU1D-0100-001744929179-D1UNVUFT-D8TL

43 B
95 B

114ms
109ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=07C2998F-9570-4947-B846-33E4E30B41D5&id=AU1D-0100-001744929179-D1UNVUFT-D8TL
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61ac4a87db72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=07C2998F-9570-4947-B846-33E4E30B41D5&id=AU1D-0100-001744929179-D1UNVUFT-D8TL
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:32:59 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001744929179-D1UNVUFT-D8TL&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&rub=M9LXS2TY-4-BMYX&gdpr=0

43 B
95 B

115ms
113ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&rub=M9LXS2TY-4-BMYX&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61aa9839db72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&rub=M9LXS2TY-4-BMYX&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 68924088df51cc4f44725d2003b1af80
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001744929179-D1UNVUFT-D8TL&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&id=AU1D-0100-001744929179-D1UNVUFT-D8TL

43 B
95 B

227ms
129ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&id=AU1D-0100-001744929179-D1UNVUFT-D8TL
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61a91e11db72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&id=AU1D-0100-001744929179-D1UNVUFT-D8TL
content-length: 259
date: Thu, 17 Apr 2025 22:32:58 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001744929179-D1UNVUFT-D8TL&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001744929179...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001744929179-D1UNVUFT-D8TL&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001744...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=37173aa0-fe21-4889-af15-9a0277f642eb%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&ttd_puid=37173aa0-fe21-4889-af15-9a0277f642eb%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&tapad_id=37173aa0-fe21-4889-af15-9a0277f642eb

43 B
95 B

116ms
113ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&tapad_id=37173aa0-fe21-4889-af15-9a0277f642eb
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61ac4a89db72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&tapad_id=37173aa0-fe21-4889-af15-9a0277f642eb
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
server: Jetty(11.0.25)

GET
H3 200 pixel
cm.g.doubleclick.net/ 170 B
188 B 142ms
139ms Image
image/png 142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001744929179-D1UNVUFT-D8TL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:58 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001744929179-D1UNVUFT-D8TL
https://ids.ad.gt/api/v1/amo_match?turn_id=8613648871061682592&id=AU1D-0100-001744929179-D1UNVUFT-D8TL

43 B
94 B

178ms
111ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=8613648871061682592&id=AU1D-0100-001744929179-D1UNVUFT-D8TL
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61a91e15db72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=8613648871061682592&id=AU1D-0100-001744929179-D1UNVUFT-D8TL
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&uid=9c4e8251-f3fd-4a56-aef0-793cbdc35f76&gdpr=0

43 B
95 B

114ms
113ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&uid=9c4e8251-f3fd-4a56-aef0-793cbdc35f76&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61aa3f92db72-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744929179-D1UNVUFT-D8TL&uid=9c4e8251-f3fd-4a56-aef0-793cbdc35f76&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 17 Apr 2025 22:32:59 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-156
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001744929179-D1UNVUFT-D8TL
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDkyOTE3OS1EMVVOVlVGVC1EOFRM

170 B
188 B

140ms
138ms

Image
image/png

142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDkyOTE3OS1EMVVOVlVGVC1EOFRM

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.163.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 931f61a91e0cdb72-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDkyOTE3OS1EMVVOVlVGVC1EOFRM
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=8603902614458982697

86 B
979 B

146ms
145ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=8603902614458982697
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744929179&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=F8SJD8TP%2F9qWoGs8O2Gs94MBlj%2FglUJfSB6xlEm6BLg%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744929179&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=F8SJD8TP%2F9qWoGs8O2Gs94MBlj%2FglUJfSB6xlEm6BLg%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 931f61a9ef957650-LAX
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=8603902614458982697
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.247; 162.245.206.247; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 4371cc11-9603-4339-9012-62f84d402edc
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVmYH-rrXda8bUocw-sIs_bwgb2UysSaBA9ahHmFmANjUm12mFnReUpwP5mg0j-k9xwKm-YNa1u-v5Cp7ZlJId-wgPsReHTMSKQOR7NWY5X_DPvJ_10dZjS2T20RtP7f7G66bovFQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Gc6jvHKlWFcUjIYpRMkJtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw05Bi-FB_mfUHEAtxc8xubjvAJrDifb-ekktSfmF8cn5eSWpeiW5iSrEuiF2UmVRakl-Ewk4tA6nIyU9Pz8xLjzcyMDI1MDE00zMwiy8wAAAaYyOi"
content-security-policy: script-src 'report-sample' 'nonce-Gc6jvHKlWFcUjIYpRMkJtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVmYH-rrXda8bUocw-sIs_bwgb2UysSaBA9ahHmFmANjUm12mFnReUpwP5mg0j-k9xwKm-YNa1u-v5Cp7ZlJId-wgPsReHTMSKQOR7NWY5X_DPvJ_10dZjS2T20RtP7f7G66bovFQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-PqIDA7iOWY_7oG7z1t15Mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAtxc8xubjvAJrDj7hp9JZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRqYGJopmdgFl9gAAAdHiOw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-PqIDA7iOWY_7oG7z1t15Mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUuPQd35Hiux_VhKc7JYe3t9J_kfDHlhPwc-BF9BkJFAkOTC0_eQYNkMCj0z2OaA7BeXhDV5b64eyN7VvRLmIVFI5BGoZgVMtkILmS5Ax0sLgWLlqjYJDlN2NtADorQ67wvTuTiSQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 147ms
146ms Script
application/javascript 172.253.63.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUuPQd35Hiux_VhKc7JYe3t9J_kfDHlhPwc-BF9BkJFAkOTC0_eQYNkMCj0z2OaA7BeXhDV5b64eyN7VvRLmIVFI5BGoZgVMtkILmS5Ax0sLgWLlqjYJDlN2NtADorQ67wvTuTiSQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTI5MTc5LDI3MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5LDZdLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsInpaR1NGeGhDLXpJIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInF3eHouZG1jZ3JhdGhidWlsZGluZy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ad8fa8d814feeea96ff0885305ee2d419229db5ce3e29ccff0a090bcf371449f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-VynpFvYqDOSSjVcY9my1sA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmII1JBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYjj0m6ypgFx796brDeO3GQV4uaY3dx2gE2gY9UDYyWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxNDMz0Dw_gCAwA4ITLc"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-VynpFvYqDOSSjVcY9my1sA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 219ms
218ms XHR
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

f73c700ac653ee12d3b1b7843057de160b859f3c7d85b5014999365a00b90057

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/json
vary: Origin

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
112 KB 134ms
134ms Script
application/javascript 192.178.155.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yuiadrs-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

c6405a946c381985a99475bcf0dfd109df1298a7afc59f707caf57984605ef24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 22:32:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 114566
x-xss-protection: 0
server: Google Tag Manager

OPTIONS
H2 200 dec
p.ad.gt/api/v1/ Frame 0
0 242ms
114ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/dec
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 931f61aa3aec5397-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:32:59 GMT
server: cloudflare
vary: Origin

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
112 B 119ms
115ms XHR
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 931f61a96f65cdfb-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 332ms
107ms Script
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 931f61aacf7c7bf7-LAX
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
server: cloudflare

POST
H2 204 dec Show response
p.ad.gt/api/v1/ 0
34 B 105ms
103ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/dec
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 931f61aafd545397-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:32:59 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 189 B
222 B 106ms
104ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14c2471c404dd45c553ab24ef114a7be5d3079a23456a94b84408c0856a97fd9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 931f61ab5bb823b2-LAX
access-control-allow-origin: *
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 303ms
104ms Preflight 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 931f61aaa95623b2-LAX
date: Thu, 17 Apr 2025 22:32:59 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 20B5 0
0 140ms
139ms Fetch
image/gif 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlN78BdDR_Rlju3fsEWy9P7loEzYr95cttLmjHo5D52SpQfEgU4xHpsh2IIz3PU0cufs6jZfxErEaxx1FYLqlIC1aKMwYrlQ_ObKwSwx17fTjFK6Ci6LnfHy7t32qNprTWdIabmgut6MLFVjJlo4LmMhAucbptcEC3uC1PgqSW4eK8I363-dlVtx9UZ1610ezcTSPiopUfep-yc0xI6D2c7zzFwp4vYLRNEQ6Hft9jTSnF3JLNlTh8fnKNTyBsDP-nRnNdHgIiQBE6PTJu9yv4aMpA4imGD8h0ZgNdCg3Jr3AT5VIjEkXGrXSk556rJXLhdj9tog_Wjh2eH4HWKrTK3sJZluizf-4Xz-Usi8ecbxJNF0cIZrQStfDywJ0jp-LE-q6oT44EuouDZ0joz6oiYdouhipvbSRYBBekT_TdoxB-VGNyBjqPEBJxTpNTFFXN9B6qEKPDfX5dMrhp5YR3-cp9-GBRhA83InQ49eB3YHii2iyFGJ1D-XOCZi-Ukg_W_YrXRYE1f6s6jdJ4xL9edCsiQZvMj3B2RywgjNyTaqivBnymrTpQLtZDAGYwd7_7Rk70_bP3E2qukdHtUla-o2ic&sai=AMfl-YQcdt3PmrjBVAEY3lJ1ZgyooPuyrV2X9eb8njLLNR2X_dNH0fOJhCw3fT3TIQWFm2fs2N_B8hFkquXWit7F5Xs84FRk5_A_IZcmHAuK7qi0QcRlueTzwnK3syc&sig=Cg0ArKJSzKvuvSp5A7cmEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9275 663 B
254 B 390ms
139ms Document
text/html 142.251.163.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJaQJxCxrLIBGNLtxbACMAE&v=APEucNUzfwwbTHKb0V2TT5CfgursZcydQtDTE6uUVlPTDxhU7tUP22GAuE2yvIbhoBpvkM3YI8-G24bykD4vbBaP_AZoJGuVxg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

cafe /

Resource Hash

962d6dea088b031cd44d33f937adb5ba241a9435aa32a8be667d57482b8bbe1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 22:32:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 20B5 110 KB
37 KB 156ms
153ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 18146946010209014275
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:32:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38116
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 42 B
63 B 355ms
352ms Image
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AbrOK42mGEyrPBLzVQ5tL8IMfCyHDbO8K525LmoWhZ3BLnA0RHtbXd_D6ODs5Gml-Rk6zrIoSjBoPgdw6tQY5agfZI06GbzPXbJSed6BW2FMALvI4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 88177ce3-15b3-4b59-8628-86e04599d1b1
beacon-iad2.rubiconproject.com/beacon/d/ Frame 20B5 43 B
227 B 465ms
122ms Image
image/avif 2602:803:c002:200::64
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL

https://beacon-iad2.rubiconproject.com/beacon/d/88177ce3-15b3-4b59-8628-86e04599d1b1?oo=0&accountId=12556&siteId=110932&zoneId=523774&sizeId=9&e=6A1E40E384DA563BA1C4F25C6039345BE31B16F50F201B2F9F69F2618ED02E31E57DF02B89D0D23DF97ED94D96082F94A812BB8DA8A579639E35B738E42E58429663BCE142C91299874A741BD1700A53F14FC5DDEA1D633A688EC68363FEDAA73EC89D6084CB632A5D966A92A8E35E64486202EE01C46290F9D2FD7F3ED887BD97F998B6BFBB089B0D8735EF871140B079C3110BBC6E936095C1F8F3194301820DF6779789F571D9A59E2F029694ED8DDCA623357DD9D965

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2602:803:c002:200::64 , United States, ASN26667 (RUBICONPROJECT, US),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-content-type-options: nosniff
expires: 01 Jan 1970 10:00:00 GMT
content-length: 43
x-xss-protection: 1; mode=block
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/avif
x-frame-options: DENY

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 20B5 221 KB
68 KB 123ms
122ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 18003062906086184080
age: 1679
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 23:05:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 22:05:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69570
x-xss-protection: 0
server: cafe

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 848B 803 B
1022 B 125ms
90ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 891664273714dd31671d2a418b09efb6ab0f424f5b75475c3d059927f7f79319

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Thu, 17 Apr 2025 22:32:58 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.247

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame 2C39 11 KB
5 KB 235ms
105ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b&neustar.biz=E1:DOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ/acDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5/3xjaN7DxSFV4woesoHh+1VheY+Nbd+PLdT92jXMzuHwO+i11lggBrftBIWk5xnZu+cHxCKBGJxjbrgiRD1bJqIv/YdchLbjfYyBe0mkvq/fF8wVjRIuPy2mScNnm2e1N+2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY/pFN+h8JrXAvdUqzMo8PkECyQne2t+HbUdlTT8DWCdgMHnEWX+HiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY/kxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF+NamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa/gSDAfg819dZT/59T82ho8+Jn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn+vsWEwipMYdhWA/SWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD+2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF+1LFwvVdtN2ITEQHXgpKp+/g6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf+tyPRbF7pO/inkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX+mzocMX+O0Qn6IqG12y16phMyPqpYGrUscm+fQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG+KrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ+CezqgT/o+XFBL6vnIpwP3REVonvk7OJUbeqOxzf+Kar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS+4C/Gt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6+11W/PUNmco8NjAdmBoSbqHHWFpJL/Xeit6tkG1C67z22eZsu/YjERd1P13cOpvVqBOupEereCOZoo2bduJ75S+OvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ+8UuT2/F1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j/SmcbcU8k/GQSpFITA89eDIjMMw5OUh9LF/11LAE+sFzsiKDS0ALiH5y4uT/BIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&liveintent.com=13-3whu/zqPFbjZmcrjWUTuRmm9Hs49AkbGc+kQdqu5E9jXvR6ld0VfO19sMvsAex46/FtjbyxEi8tkXdh/QZKt/C8xWWWXM8ObJznKCWZTiYcLJQ==&bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c&liveintent.triplelift.com=1075601553087813430040&media.net=3782028751764519000V10&rubiconproject.com=M6VCOCYF-1C-3A8E&liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA&1278&openx.net=54b91979-23f5-4565-b16f-b33a236f2354&pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB&sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0&liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1&linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744929178124&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72c52f43b1661fffb83e261740f8929aaa506039484acec8a2e6568ca6b31085

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 931f61aa89bccbae-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:32:59 GMT
expires: 0
last-modified: Wed, 16 Apr 2025 11:15:45 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 31E1 20 KB
7 KB 123ms
123ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=151498
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 22:32:59 GMT
expires: Sat, 19 Apr 2025 16:37:57 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame BFED 1 KB
2 KB 133ms
133ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: affda062a8f507addb849a9b6de5d971550ef71d7fb92c17f5d9042ccc33e3ca

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:32:59 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B1DE 52 KB
17 KB 681ms
210ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 35089
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 17 Apr 2025 22:32:59 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2317554, 134117
X-Served-By: cache-lga21993-LGA, cache-toj-leto2350021-TOJ
X-Timer: S1744929180.703948,VS0,VE0

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 8708 0
0 133ms
123ms Document
text/plain 198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 17 Apr 2025 22:32:59 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 716C 2 KB
1 KB 374ms
123ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 22:32:58 GMT
server: Kestrel
server-processing-duration-in-ticks: 67186
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 23EA 3 KB
2 KB 251ms
74ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 118
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 931f61aaecc5cba0-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 17 Apr 2025 22:32:59 GMT
expires: Fri, 18 Apr 2025 02:32:59 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame B9B6 269 B
379 B 724ms
703ms Document
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 17 Apr 2025 22:32:59 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 126ms
118ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=Dc6AZl9UMEhUeG5nN0pvSVRJUHJuJTJCblVPNG15bEo1SERiS3JJTHV2QXMzUExZTWslMkJEMHZxNVN4MWpRc1dkNk82VlJJRVklMkZxSmtKMlRLNms4ZndPQkIzVlJDJTJGVnVycFAzM0MxSCUyQlViZjcwR3glMkJKMHczOG1JZUpIMnJKTXZYUlQ1eHhqMg&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 22:32:58 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 214804
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 223ms
215ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-72-120-238.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
660 B 131ms
122ms Fetch
application/javascript 34.232.220.61
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.220.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-220-61.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 0c51c216b9680ad7cae0188dc9b11d45e39b6d626fcd95d5a094abe7a2d5f93c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 98ms
89ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&us_privacy=1NNY&tp=fxTHQohlAmq5tUkgr%2F6A3M6pRXHnBhp6pMM11Idx6L0%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 1d2ed074048b9ab474f8645eff2363be7c909873929cad43d395df42f5c31c31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 520 B
0 6ms
6ms Fetch
text/plain 54.158.52.71
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js2y4f5xnsfmr6b4zzafgpnm&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.158.52.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-158-52-71.compute-1.amazonaws.com
Software: /
Resource Hash: 946eb951c1c1a19b169a2d0f1016cd5e23e1a01a15be3132a85423e14046eaf1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 693c2ad334b885fe
request-time: 6
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 22:32:57 GMT
access-control-allow-origin: https://paint.toys
content-length: 520
date: Thu, 17 Apr 2025 22:32:57 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 124ms
123ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 284476
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

ibs:dpid=903&dpuuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc

42 B
715 B

129ms
128ms

Image
image/gif

52.72.120.238
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.72.120.238 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v076-023649f75.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: nEwkrvoWQ+U=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc
content-length: 189
date: Thu, 17 Apr 2025 22:32:59 GMT
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&us_privacy=1NNY
https://cs.iqzone.com/a29fd8b19731bab59f20e229072c6f1e.gif?redir=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D494%26user_id%3D%5BUID%5D%26expires%3D14%26ssp%3Dthemediagrid%26bsw_param%3D${bsw_pa...
https://x.bidswitch.net/sync?dsp_id=494&user_id=fdcc5492-9dff-4edd-96c0-ef1c62be8433&expires=14&ssp=themediagrid&bsw_param=${bsw_param}

43 B
103 B

141ms
138ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=494&user_id=fdcc5492-9dff-4edd-96c0-ef1c62be8433&expires=14&ssp=themediagrid&bsw_param=${bsw_param}
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://x.bidswitch.net/sync?dsp_id=494&user_id=fdcc5492-9dff-4edd-96c0-ef1c62be8433&expires=14&ssp=themediagrid&bsw_param=${bsw_param}
Pragma: no-cache
Connection: keep-alive
Expires: 0
Content-Length: 0
Date: Thu, 17 Apr 2025 22:33:00 GMT
Server: nginx

POST
H3 204 AGSKWxUIuO-SYktTMX162Z7bTX52-6YpMKoEJRLw1EPRhjAdoECtrsWHNqVBtd2z5SXUh-_vGIIOGlSGPlgmH9BsFcnQExL4pWaWDqZYXs022aIPlYcnzuXKg_NVUXmYEM__jlbCqEfeEA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 139ms
138ms XHR
text/html 172.253.63.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUIuO-SYktTMX162Z7bTX52-6YpMKoEJRLw1EPRhjAdoECtrsWHNqVBtd2z5SXUh-_vGIIOGlSGPlgmH9BsFcnQExL4pWaWDqZYXs022aIPlYcnzuXKg_NVUXmYEM__jlbCqEfeEA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RtTSsYyW6552NXcveK9mCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1pBi-FB_mfUHEAtxc8xubjvAJvDi3qdyJZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRqYGJopmdgFl9gAABUDCRy"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RtTSsYyW6552NXcveK9mCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 119ms
118ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 17 Apr 2025 22:47:59 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 17 Apr 2025 22:32:59 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 848B 170 B
243 B 134ms
131ms Image
image/png 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 848B 170 B
232 B 135ms
133ms Image
image/png 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Zjc2MzJjYmYtM2ViNC0yNDc2LWQ3YjktNWJmNTc2MmIyMWY3

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 848B
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=db0cff75-f7c3-7ad2-c259-014cbcc9ef97&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

122ms
121ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 17 Apr 2025 22:33:00 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 848B
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/4fcb9931-676f-e89b-f38e-17b9439e22de?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-iMedwlxE2p_sAb6A6WhuMRRZJA9dEP2fG2k-~A

43 B
136 B

163ms
86ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-iMedwlxE2p_sAb6A6WhuMRRZJA9dEP2fG2k-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.247
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-iMedwlxE2p_sAb6A6WhuMRRZJA9dEP2fG2k-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 848B
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAGBmwAAAZ47GQA_

85 B
171 B

212ms
211ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAGBmwAAAZ47GQA_
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1744929180.149080,VS0,VE0
age: 578
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/png
x-served-by: cache-toj-leto2350046-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 2294

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAGBmwAAAZ47GQA_
x-timer: S1744929180.849906,VS0,VE86
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-served-by: cache-toj-leto2350046-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 848B
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8613648871061682592&gdpr=0&gdpr_consent=&us_privacy=

43 B
97 B

97ms
92ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8613648871061682592&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.247
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8613648871061682592&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 22:32:54 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame BFED
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

137ms
136ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 17 Apr 2025 22:32:59 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame BFED 170 B
232 B 136ms
135ms Image
image/png 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame BFED
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTQzODg0MTM1OTQ5NzAxODE1NDY2NQ%3D%3D

170 B
232 B

141ms
136ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTQzODg0MTM1OTQ5NzAxODE1NDY2NQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-215-89-122.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTQzODg0MTM1OTQ5NzAxODE1NDY2NQ%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 22:32:59 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame BFED
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTQzODg0MTM1OTQ5NzAxODE1NDY2NQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

139ms
134ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame BFED 0
249 B 355ms
162ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1438841359497018154665&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E69A57C8652A4A59A13DDC8E89DB2737 Ref B: LAX311000115035 Ref C: 2025-04-17T22:32:59Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzAPvnmBk7fu/vOul+tg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 22:32:58 GMT

GET
H2

200

sync
pippio.com/api/ Frame BFED
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1438841359497018154665
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=3aa020a2-f557-45cd-b49a-5bd4eb261515
https://p.rfihub.com/cm?pub=39342&in=1&userid=4bac8835-3ed4-49f9-9703-bd2fc6113482%3A1744929180.2393293&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D4bac8835-3ed4-49f9...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=2810316584722766590&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D4bac88...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=4bac8835-3ed4-49f9-9703-bd2fc6113482%3A1744929180.2393293&pid=500040&it=1&iv=4bac8835-3ed4-49f9-9703-bd2fc6113482%3A1744929180.2393293&_=174...
https://pippio.com/api/sync?it=1&pid=500040&_=1744929180.2409098&iv=4bac8835-3ed4-49f9-9703-bd2fc6113482:1744929180.2393293

42 B
344 B

246ms
116ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1744929180.2409098&iv=4bac8835-3ed4-49f9-9703-bd2fc6113482:1744929180.2393293
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 17 Apr 2025 22:33:01 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1744929180.2409098&iv=4bac8835-3ed4-49f9-9703-bd2fc6113482:1744929180.2393293
Content-Length: 0
Date: Thu, 17 Apr 2025 22:33:00 GMT
trace-id: d20b4a6530a8de1a
Request-Time: 1
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame BFED
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1438841359497018154665?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-OGmeuCJE2oT7wra_lkpl6sVT7VllzWxxhj_UItQnnw--~A&dongle=0883

37 B
476 B

138ms
137ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-OGmeuCJE2oT7wra_lkpl6sVT7VllzWxxhj_UItQnnw--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-OGmeuCJE2oT7wra_lkpl6sVT7VllzWxxhj_UItQnnw--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame BFED 42 B
690 B 335ms
91ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1438841359497018154665&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "e8cf83ed75a9db1:0"
x-msedge-ref: Ref A: 976FD84226624E33BC21949E4BADD1A3 Ref B: LAX311000108021 Ref C: 2025-04-17T22:32:59Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
last-modified: Wed, 09 Apr 2025 17:36:29 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame BFED
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=6afbe89f61d2153e&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHfZAn-LB00gJgDL7GAQEBAQEBAQCXRONIXQEBAQEBAQEB&expiration=1745015579&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

140ms
139ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHfZAn-LB00gJgDL7GAQEBAQEBAQCXRONIXQEBAQEBAQEB&expiration=1745015579&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHfZAn-LB00gJgDL7GAQEBAQEBAQCXRONIXQEBAQEBAQEB&expiration=1745015579&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame BFED
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-91f1468d-4df4-5b29-56fe-95dcab34da07$ip$162.245.206.247&dongle=4430

37 B
476 B

142ms
136ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-91f1468d-4df4-5b29-56fe-95dcab34da07$ip$162.245.206.247&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-91f1468d-4df4-5b29-56fe-95dcab34da07$ip$162.245.206.247&dongle=4430
Content-Length: 141
Date: Thu, 17 Apr 2025 22:32:59 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200
OK

id5
match.prod.bidr.io/cookie-sync/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*kwP-LMViNuibhSW7q3qQw2xyeF4WSaGayKC3CxtvBo8PQXNbIpwS0MLf9obAGxkt&gdpr_consent=undefined&gdpr=false
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F7%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/7/2.gif?puid=9c4e8251-f3fd-4a56-aef0-793cbdc35f76&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/6/3.gif?puid=37173aa0-fe21-4889-af15-9a0277f642eb&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F5%2F4.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/429/5/4.gif?puid=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=

43 B
433 B

505ms
125ms

Image
image/gif

3.215.89.122
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/id5?us_privacy=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

3.215.89.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: no-cache, must-revalidate
pragma: no-cache
Connection: keep-alive
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length: 43
Date: Thu, 17 Apr 2025 22:33:01 GMT
content-type: image/gif
Server: gunicorn

Redirect headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
location: https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 31E1 5 KB
6 KB 388ms
127ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=90423900&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 3de82f559b1221cf660479c903bd08cf3f30c0d8b8293ed0f098b8d21fcd1d74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame EFED
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid...

2 KB
896 B

103ms
102ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ce80560f42ad3b7f1622d4599a38539278ed1a95bbdfccb9e0b34342053d921

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 931f61ac7cc169b6-LAX
content-encoding: br
content-type: text/html
date: Thu, 17 Apr 2025 22:32:59 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HJIH73Y70jQohzKiMAU%2BuG6S3MHYGbTH8tc3KGWoKl6BRFrkk4QjED4kEpGvvC5MVWhj2KWDEW%2F7JLfwy%2F9K2ITLfqhxxJ%2BxecqrMSvQ9RaqXV%2Bt6kkQbnjvHBO1UT3kn4mgspNUrEL%2B5g%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 931f61abec3d69b6-LAX
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VCwXDA8bqOd5pZl8F2ooGwjwsviUMBup5KdBjTyd5npvPtro73blvVWIx34Yz4dK7ywIoRNnZulvpEqUc%2BY3cO9LNQG%2BFEalzo%2Bmc59UAmXE03LX9DhjuMcY0LVm2bEH8godtfyKbQtq%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 2C39 19 KB
7 KB 212ms
78ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b&neustar.biz=E1:DOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ/acDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5/3xjaN7DxSFV4woesoHh+1VheY+Nbd+PLdT92jXMzuHwO+i11lggBrftBIWk5xnZu+cHxCKBGJxjbrgiRD1bJqIv/YdchLbjfYyBe0mkvq/fF8wVjRIuPy2mScNnm2e1N+2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY/pFN+h8JrXAvdUqzMo8PkECyQne2t+HbUdlTT8DWCdgMHnEWX+HiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY/kxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF+NamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa/gSDAfg819dZT/59T82ho8+Jn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn+vsWEwipMYdhWA/SWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD+2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF+1LFwvVdtN2ITEQHXgpKp+/g6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf+tyPRbF7pO/inkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX+mzocMX+O0Qn6IqG12y16phMyPqpYGrUscm+fQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG+KrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ+CezqgT/o+XFBL6vnIpwP3REVonvk7OJUbeqOxzf+Kar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS+4C/Gt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6+11W/PUNmco8NjAdmBoSbqHHWFpJL/Xeit6tkG1C67z22eZsu/YjERd1P13cOpvVqBOupEereCOZoo2bduJ75S+OvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ+8UuT2/F1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j/SmcbcU8k/GQSpFITA89eDIjMMw5OUh9LF/11LAE+sFzsiKDS0ALiH5y4uT/BIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&liveintent.com=13-3whu/zqPFbjZmcrjWUTuRmm9Hs49AkbGc+kQdqu5E9jXvR6ld0VfO19sMvsAex46/FtjbyxEi8tkXdh/QZKt/C8xWWWXM8ObJznKCWZTiYcLJQ==&bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c&liveintent.triplelift.com=1075601553087813430040&media.net=3782028751764519000V10&rubiconproject.com=M6VCOCYF-1C-3A8E&liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA&1278&openx.net=54b91979-23f5-4565-b16f-b33a236f2354&pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB&sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0&liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1&linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744929178124&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 931f61ac2f602f5e-LAX
access-control-allow-origin: *
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
20 B 131ms
130ms Ping
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5384010508943&version=m202504010101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
20 B 130ms
130ms Ping
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5384010508943&version=m202504010101&ct=76&x=8&cor=15384982277677361000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 20B5 81 KB
31 KB 166ms
160ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AZ5mk9ajWu8ITKPdjOoV4WdMQ1DIaYWQy2rVUpcXzwUsiHQy-2MvawuBC4l0LPy-TSLBaMSIbtk542r_H_Y1PzdZkAhWhEGS5Xo7592WeZ4sEYyj0hsG3qeU5Bkb9dwbrA-9mj-VncGiXreI_4-aL5ERyz8Oekamx3RJ7w6zNrjAi7Xvl9DTDOlV94plqdIKKJsRogY4KLfjK0tg-oavfE7faXF5NdhwFyc_r81RDtYVMzHxFwFDL7g13la-vMOW781e0LDbOLOX_9rWQM5cx1e4vMFg&dbm_d=AKAmf-CvXzFTOrpsCGDTAPIU5Ae28NW9wV_TejY-tB6hza9_uE5UpKCnXt5ruHYufgev-yqf826C3s76ZBBAjJdtYMNZfwgAzkWzxi6L4_7BBjwkahV1Qb9aaMtTbZGGcMMKUg1zXvkglMg6xQdTwk6mobCXKwY2G5iEKiEfNubm7OMgHGf09RSvE7bJT3f7CBSq5KSTnX0ueE7SJetGOMSDQWkke7ZQmVYodPJl1T6sEpl2wrcY1avOnChdaiDs5hxewX9HYbyOMKJ1vQhtf1mRvxd6iRHsTWdQPrxziA4x9vTRvukHylwKEf_asue60NDKnLawd9nRd-H2QfSyI6GNk2StrrSlwtvMeXX9jpatZPeSB_fojKBFZk7Q_cpsV68aOu42jOVLoV-f-_vvh5Z1y7GqncsvwtMHOmLujxIxVYulZaru_sQCpEHwWUk7yytnQddKIXazaduex_ZRNTZYvozO8_XZOacYuqTAyrWWt_3_UdSyN31QwCpMigCU0hz58x5Z8ejIWNWPaQiSHBjQDvOZGzdD7YgDB5gi2-6nHuh9OGtITgASJjFqrrqi1CEHMIgaMQ1WI97HFoszQdH-UGK2kiCPNIB4NLhJPkPr8C_QlLgJ6fykVPPNjyoEqbVnZAa2uDUgTvK98WLmZTgy2oBULP9FZAjh1Qgz1veNZ7-VuMZzeHxcVik80CIwLCqAy6a2XD6gd2Ab7EEmkiaSIUzj6HBbaYwL4WAVYuK5e976vkiqCxEmlQjGHmkFXR5Q-enLzJZOKsSmm2B7IwNQOWUEi9VmTQx1t7XHJjLEIAYsRyt11mMvg5_mbf0Wb2RWEbb2sv_Xo2IePsSyfUYZY79cbHSSWnCoqAVIzJODi_MYcs-Pg9oRTOAKprP5XTPdJnxDFNH22_tUn6HAz2QzZxTLORM-Br59Z1iuIpXkJ8AMcIXZex4OhDONQqDgzPINA6xq79t8kNSnl653NBRtjhnrQfF0PpR7Rq8z3invv8Gl3eL-5IfxCT8D7XW0K8WRaKHU_7rUbKtL3jnSbuousg1NfE1FMMY7Vb3SkdyxIu3gHYcGhqRr21uaCNcIMADSJzYMQ_BGn0J5puM14NSl41CiUQIYkqUvlSRq6ab0mAI1LIeVKuMueKe5EnvZvUimonjRjjw1D-n4vKeOeq6TbR3ZAVJ4BMjBqBpRm0abowdF2V47dSm60FiK3xH3YgyXPG6XLc1t2cG5h8ZGsJ5u8KPFlz_3-QnN_27WXP4SZlxpJ8YRrwkx8jlrVt3lODCYXyzDCKzPQToSzG65DprFiDKwq-mlxJmQb7ymJQgBTVDJc_XsUmmA-D4EawfOu0cyE2K-ZvMzez1MM70ofztgyBeiCaMlZG1qJhkZCFBd1zF5hkZPFFUThyemTr74dqyKZDW5GT_mg4upYEHXXwe8NMSY_3V_h1lt0BrYKzXvsOljAW_3j4CWTiOjKkmGwF1oAxeZUn9Us2dS55qT53tlW8nchu1E4OPuuvw9hDSChvcvVkrWCjv56D0qfxYDBTG98eGOCVE0xEa9CG051Dcv9tpRQUeccnSy1VnCWggZUk8Tf2VSEy0h4KYECZ3JSDDKqSKvfaEWklFsGVBwkhbD1tpopIGAQ32garP72AncU5ekqz4A2DlrsxWqHbCblXOlMqryPHHGpIb3xGq0Puk9EOkZbvGX1KQdtghiHYnEd_oaKzxdyWtJhQWz1ixxWJT3E7ZVBsYOiqyXM0fEMcAeiEg7g9aTf7SIdOvL1pt0La0NTNkGsGN_QRix47a1vZFSKTQRaUNl6IsJRq4ru26uOcp8riEFam6a3WvHYHGejswMUXOM3-E7L2hMjL-zus2d3mX6JE3uVd2I6EUbec2Z1ih4I6-mFk4-d_-digkCpL1j9LBowOlV5byZiugsuEAP5FjBnPIg3dAvkAvY1lx97LtrrzVuNTHoP-bgDD9LXBhMV9qYxtOQGQ4hRGDO7JFPZw-rugzUOq2q3A6qe0kbUBqvjzqZVKN8FdtAXPOygDVrmV4AYSUuyyL2vSZ5ZFQ--5SQIcZtvbB6zrIGadTd2BHeePwX1ByJ4HTRwKoBgEZENRotZAHI2yogpVvB0UpJfRvtKh9SDC9sHjtA8ojFsgpzeRWz5GR2pj9uj3M8MrgyC0AUK2SLG94qzK1WenFR5KsAcjaNHe8neTT0VC0K1ddsX2H7y3CNdH-e2nMWJD5UDFeZsVSp41bml8ibCIZmD2BsC0YHE3xZ-x4h3w0Qou5zX3mJnMXpIy_NwhdZdVnHSl-TiC31DeHm1CTMGkUI_NptDzZrW3EoKQuPya3OuRqFnxrXaSiZQR8MuNOqI1rVYXkFSg1UOZ4vsFXWZBuDdUzMgj06Tm8b3zJDIcnRAwvUeboF1m5YceqcMwQV2V7b2ZedputREvF8LMLy4dsBdw60JBBRoY92fBm38BaX3Frow12-gHQZ7jKMZAayLITaLPLrhb-FjpO10WVTYgtFpBEcgbWfp-4kZF0GmWPg0QTqKsgIUjf155kgZtcqtTR4SLdx5othwqWIm2ho-Rg6Xfd0DeoxUvEvb4ZX7RTA_Sij3fbj6LnNMYQ7M7I8BthvUv8sPpcWhDgcEyZKGw6IngjOUPG1yMofENTwHdTwJJLvz2m84uPlEjheUORr-4l7efoX8C6VKbUrBCQRpLp7FouX1sRsWdVYkXxdJFG-x72n3sy4ozz2YeA6eZpja3Zhc_H7izVMrVclnWEYR3FdI_IAw_GsrNP7CZePrhzi7wNTEF4_qsIy8BFTB7RGqeToS4EvWLrO3p6mqf5YT6f_dZ2XHdAEc3kIrf43X63pDpKHIT25USrBJHqWtAMBsOMMyAnHQN1a75SZw4dMm-4uDlOZiChFLUgsVR_Ufw00xKntdJgD0dW_Zmc0G6bKKnL1i6r8I37wG2V9yf4TOLiKgjQVPKeljqE90bBA1eXL9jjRoJuTEI3-nYKv8Y61Ix0-ECj0gusMk1L_hLVd9kaXpTuG4v4hnS1der8kbaDcF629C-4LMkz25quYAf5u-1qv8qxb5xax3iV0GOKA7fRKJsaoKsMIWDQgnYzvNLeHsTY_w4NacMvrEjtlwyc0aksXFd-tvv8D_mG9v4sWUn8Za1fa7EwWHDkiCMr5-RFGJqU2fXNLi59Vl7jfdUcxATWuDoke1Sbz646JA5JIxoRnUXqhwXzNYXvkN7sYfctS5i-DsixgJaBF2j2vS5Gxog4BUvDldt1BtYlQnmNHrSjVJQ0NH0WCaz48Uv8Iq0lBAFT5tOV1CRwpfMPMhuKH5oUIGnjuWK43Pj9vJ9kHkcYGoG5FMwIGBtgZXX771H3yMD7lXAxvHc1P9AfXWFzB2m6qKHhC4ceo0sRQ_W1J13OGftdaFHXxe3WpijdUCLLukwuzcCq3_cSUFmWScg7zQ_YTh3PBKK6S0Mqfn0mX4nkSG_2upb2wRWvBBg5uL0HxOzEUMk8prTwEVxnl-uhg7s_wJhNxS9yYFnMO0eyV_qheOHk2oz5_NcYW_ooDrs8OFByyPUgnkd83t0ds7RSh9qmWUb5TDv4m7GMDQQo8Sy-lIVo5nKUnnkYMEidBZ3zIQZux7kYGx6D4T_JypPdsdKOCY7eybEQL6mlHRC80w6yMDUpeBa2ED72Q6gll-d0Qgilik7_QlwmIMEFPKhd7loS8Hs_O1TiQkj09M6MEv06QC4rjy4sKNBs4JN0If4FnfI5jV4aG4i5pwEA0RbpVugRnZ9vR5fNupWYMmGdPqueA42Mcy8RiOAT11DMADVHSc_xkaO4HSljYnqzqK4GgolK_SuWh5BGpolRqRD6TBENS0q8ctptTfpnFDvU8Msou1OIo-C1hliCHxSTxnU4eUyhxbBec-zWxN3hEbOV20OW_i582jRtI8CBO10RVTr1qO7QVxLHl1at2D0vHme20GrRdzxD9NAnVF3v4V9WGx4JvwDbWwDhlk8ADbbj2bGPZySCordiPaEqrGc_IwA0lV1q7VEZfUHnR2ASbkiuCpVQcColk-1ph1CuYS2c_CUmok3WAICmLNg6q-Cp1tbU7U_iwdY-Fj56Zw98vwD9EaFnyEO0sxLz1FIILGUhIRYqjTBUdpPPSKA&pr=8%3AB5A1AA3B851CB150&cid=CAQSjwIA2abss7WFiNAwDM_BhEKQIf6wvg8WSc0LEe8FChivv1NUN4L_MX3DTdvrD3yaV3or63I5_IDC_0oT7oHGmsb-b-ktFlIdMnGE6DcDS8LvxiW5weQHy4sbHZ61uf2hUXUtAkbG55o_c8vLR4DP4Vrp88vCI6IoZ0fmGoPCl8I9rHiSFY7l8aRQ3kYoYSK_ERak9W7bx9990fKRNs4tqmBWIZlT7Vu94Net2V4lCEcsAdljXRuW0DIie0GEXHQhl3BcCqr4l0UFnhvWcb0D9w9ZH-96JBvt2pXfGRaURovKQ0E9oKZYkwjoafplMcfz7-Tpy2HfYDrMT2xDWRRNzDE-wV9Pa3YrQc06ZsV3mlJoGAE&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&ct=76&iif=1&cor=15384982277677361000&adk=1627501012&idt=259&cac=0&dtd=130

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17deaa561097e3798cb193e894237db901afe9ed3ea4070805c201805a72da68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 31410
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame 2C39 4 KB
1 KB 138ms
133ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b&neustar.biz=E1:DOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ/acDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5/3xjaN7DxSFV4woesoHh+1VheY+Nbd+PLdT92jXMzuHwO+i11lggBrftBIWk5xnZu+cHxCKBGJxjbrgiRD1bJqIv/YdchLbjfYyBe0mkvq/fF8wVjRIuPy2mScNnm2e1N+2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY/pFN+h8JrXAvdUqzMo8PkECyQne2t+HbUdlTT8DWCdgMHnEWX+HiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY/kxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF+NamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa/gSDAfg819dZT/59T82ho8+Jn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn+vsWEwipMYdhWA/SWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD+2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF+1LFwvVdtN2ITEQHXgpKp+/g6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf+tyPRbF7pO/inkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX+mzocMX+O0Qn6IqG12y16phMyPqpYGrUscm+fQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG+KrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ+CezqgT/o+XFBL6vnIpwP3REVonvk7OJUbeqOxzf+Kar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS+4C/Gt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6+11W/PUNmco8NjAdmBoSbqHHWFpJL/Xeit6tkG1C67z22eZsu/YjERd1P13cOpvVqBOupEereCOZoo2bduJ75S+OvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ+8UuT2/F1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j/SmcbcU8k/GQSpFITA89eDIjMMw5OUh9LF/11LAE+sFzsiKDS0ALiH5y4uT/BIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&liveintent.com=13-3whu/zqPFbjZmcrjWUTuRmm9Hs49AkbGc+kQdqu5E9jXvR6ld0VfO19sMvsAex46/FtjbyxEi8tkXdh/QZKt/C8xWWWXM8ObJznKCWZTiYcLJQ==&bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c&liveintent.triplelift.com=1075601553087813430040&media.net=3782028751764519000V10&rubiconproject.com=M6VCOCYF-1C-3A8E&liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA&1278&openx.net=54b91979-23f5-4565-b16f-b33a236f2354&pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB&sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0&liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1&linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744929178124&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9c96df959c86ed9ae52f6db90ba79001f4da9573e47d8369f72649d99935bfb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b&neustar.biz=E1:DOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ/acDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5/3xjaN7DxSFV4woesoHh+1VheY+Nbd+PLdT92jXMzuHwO+i11lggBrftBIWk5xnZu+cHxCKBGJxjbrgiRD1bJqIv/YdchLbjfYyBe0mkvq/fF8wVjRIuPy2mScNnm2e1N+2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY/pFN+h8JrXAvdUqzMo8PkECyQne2t+HbUdlTT8DWCdgMHnEWX+HiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY/kxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF+NamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa/gSDAfg819dZT/59T82ho8+Jn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn+vsWEwipMYdhWA/SWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD+2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF+1LFwvVdtN2ITEQHXgpKp+/g6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf+tyPRbF7pO/inkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX+mzocMX+O0Qn6IqG12y16phMyPqpYGrUscm+fQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG+KrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ+CezqgT/o+XFBL6vnIpwP3REVonvk7OJUbeqOxzf+Kar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS+4C/Gt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6+11W/PUNmco8NjAdmBoSbqHHWFpJL/Xeit6tkG1C67z22eZsu/YjERd1P13cOpvVqBOupEereCOZoo2bduJ75S+OvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ+8UuT2/F1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j/SmcbcU8k/GQSpFITA89eDIjMMw5OUh9LF/11LAE+sFzsiKDS0ALiH5y4uT/BIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&liveintent.com=13-3whu/zqPFbjZmcrjWUTuRmm9Hs49AkbGc+kQdqu5E9jXvR6ld0VfO19sMvsAex46/FtjbyxEi8tkXdh/QZKt/C8xWWWXM8ObJznKCWZTiYcLJQ==&bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c&liveintent.triplelift.com=1075601553087813430040&media.net=3782028751764519000V10&rubiconproject.com=M6VCOCYF-1C-3A8E&liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA&1278&openx.net=54b91979-23f5-4565-b16f-b33a236f2354&pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB&sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0&liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1&linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744929178124&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 931f61ac484fcbae-LAX
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 09D1 5 KB
2 KB 273ms
86ms Document
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 785
apigw-requestid: JL7RvgGRPHcEPxg=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 931f61ad8bd62f1a-LAX
content-encoding: br
content-type: text/html
date: Thu, 17 Apr 2025 22:32:59 GMT
last-modified: Thu, 17 Apr 2025 21:28:17 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 9275 170 B
232 B 135ms
133ms Image
image/png 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJaQJxCxrLIBGNLtxbACMAE&v=APEucNUzfwwbTHKb0V2TT5CfgursZcydQtDTE6uUVlPTDxhU7tUP22GAuE2yvIbhoBpvkM3YI8-G24bykD4vbBaP_AZoJGuVxg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET cs
cs.lkqd.net/ Frame 9275 0
0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 9275
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
761 B

83ms
81ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJaQJxCxrLIBGNLtxbACMAE&v=APEucNUzfwwbTHKb0V2TT5CfgursZcydQtDTE6uUVlPTDxhU7tUP22GAuE2yvIbhoBpvkM3YI8-G24bykD4vbBaP_AZoJGuVxg
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OsNPLyMmkXbtR2OfWaiDj8bAJ0DPGnWpehh79zV%2FEZ2tOB6NLfOBkWH4Jmcq6kU6iccu%2BKQuMq8tiZ7aiHxqNtPliCotaNOUX5gPbL81Kga6TFOVm8zVWjynZu%2FUoauvd5snZdrLuCs2PA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931f61ad7c8ccba7-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 9275
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAGBm9HM4WcAHw9OAM0IIgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
765 B

77ms
74ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJaQJxCxrLIBGNLtxbACMAE&v=APEucNUzfwwbTHKb0V2TT5CfgursZcydQtDTE6uUVlPTDxhU7tUP22GAuE2yvIbhoBpvkM3YI8-G24bykD4vbBaP_AZoJGuVxg
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=blm4F%2Fj9WAbyy9a6qNnxXtupqiwHlJ39vSsrDi%2FRKorytRcCILxlDnwrxOuS6Wdi45LSaWTwow6jTBGyLWHPc5zWrnXQJ8WPfJsFRurwIHvQFxgfBMF%2BZdEcI2jRr7cHmcGkAUF%2F36Q9cQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931f61aee9dccba7-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 215ms
214ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

1fd87175b6ea58f5e37928f5430552316319a3883f8fd13afa0d5ead6fb69270

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 254ms
129ms Fetch
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504140101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f155.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

POST
H2 204 collect
analytics.google.com/g/ 0
0 410ms
139ms Fetch
text/plain 2607:f8b0:4004:c08::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-FVWZ0RM4DH&gtm=45je54g3v9116367008za200&_p=1744929179075&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=1361009009.1744929176&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&uid=AU1D-0100-001744929179-D1UNVUFT-D8TL&sid=1744929179&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_ss=1&_ee=1&ep.dimension3=403&ep.dimension4=paint.toys&ep.dimension5=%2Foil%2F&ep.dimension7=edcc42ebc2b19550d2248e1d537f3ab2&tfd=5336
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
553 B 403ms
138ms Ping
text/plain 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-FVWZ0RM4DH&cid=1361009009.1744929176&gtm=45je54g3v9116367008za200&aip=1&uid=AU1D-0100-001744929179-D1UNVUFT-D8TL&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:122:0
report-to: {"group":"ascnsrsggc:122:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:122:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:122:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul Show response
td.doubleclick.net/td/ga/ Frame F018 13 B
371 B 393ms
137ms Document
text/html 2607:f8b0:4004:c1f::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-FVWZ0RM4DH&gacid=1361009009.1744929176&gtm=45je54g3v9116367008za200&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&z=365404374

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 rum Show response
elb.the-ozone-project.com/cdn-cgi/ Frame 2C39 0
137 B 67ms
65ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://elb.the-ozone-project.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=994661b9-79d8-4e7e-b969-337709db6e7b&neustar.biz=E1:DOMP1KSquPQBwO0yK5gMBGsTAC1xSFD8rS1WXUoqVwSm4UxMZY6Fc435G_cvZj8lCZQemh-DOkkpU-ryGiLVYzMll8inr_gjSGoUSNtmCv0aDWZyJWMyqjPBMr2dHNrQ&33across.com=v1.0014000001YrMoYAAV.1040.w5VuklWFOE4z4wFsJQsHbuP3ZmT62rGC3ZIL9e9L7lI9XsWGGKlmLVsNKaZ/acDjU8xDu0FweKLzkq7e3Po1wR4sZimLEkjgt7Eg4CCu026t5/3xjaN7DxSFV4woesoHh+1VheY+Nbd+PLdT92jXMzuHwO+i11lggBrftBIWk5xnZu+cHxCKBGJxjbrgiRD1bJqIv/YdchLbjfYyBe0mkvq/fF8wVjRIuPy2mScNnm2e1N+2qLb5YE22izHYPH0htSPeF2keCKHMHUqNt2zepQY/pFN+h8JrXAvdUqzMo8PkECyQne2t+HbUdlTT8DWCdgMHnEWX+HiVegMpaAiLAUw2BG1xHJKQ9jIUrpfsVY/kxGmrZoBb72HtHOpMmmwKAGpd2iaSCLoJGOKOYXCawtOg7jsor3E5D8aKFTbSTa9Xsyxn0KyMn5SMB6ZBglbcF+NamFCA5E4tkKTjLLdOAjZlpi2tGjqCw0Z0r0IRug76rbH5EDYVuNI5IuNSLmMnBAzdh44T3UDvhKa/gSDAfg819dZT/59T82ho8+Jn7Gy7Su9RxU6XNKUn58UPtwwWK7A1V3RfzM8s6TDOQxbn+vsWEwipMYdhWA/SWrfHfKSHSev1SLL3iYoEtEbju08nj2hPMt4dPbce62F5aSNnD+2ZUqgK71M8ncnUHn3GcaYd1eT9ON69yq4afF+1LFwvVdtN2ITEQHXgpKp+/g6wM2ekjvhHzKFZIPe12CRS4GCNIlCCvGLpRhkJF8GpUALuW7AkYD25yf+tyPRbF7pO/inkrrFl1zZYGmSMS6rRlnB0ZJSsoWV1VKCNxxH3UBYdJrgnC1NtEqmXZ0VxX+mzocMX+O0Qn6IqG12y16phMyPqpYGrUscm+fQTCL4IebDSBdB88Fvq49LABkSkh8YDjCO7rbdk74vdexghIflT52YiLvxH3VaimNJd5kiQwBqzBOFbjaG88cxrKsG+KrMCNeuyoyyLFSgTr05M0exn3Q5OmKlq06glUgm5YquTaQpqeYTK2bEM7YD9ayvQ+CezqgT/o+XFBL6vnIpwP3REVonvk7OJUbeqOxzf+Kar73keNheLsytobBuVPZVM0pHCi0icCoU6LZ5yZ55bHNe7U1tSohSAbS+4C/Gt7ToeJpEkNV0PD4VxwQZX9H2Uf6rsTRX51cGfmWI8uqwpGIMqwLPYLSdA2FQEON8lrdZTCep2SzSuvhxwE4KYAfLxT6+11W/PUNmco8NjAdmBoSbqHHWFpJL/Xeit6tkG1C67z22eZsu/YjERd1P13cOpvVqBOupEereCOZoo2bduJ75S+OvSzgoKgzxXSqIPQw9zmNTxDC8T4Zy74UQ+8UuT2/F1LkyCP5YCqTJvBrKUKaIT5vfNzC3gwFs9j/SmcbcU8k/GQSpFITA89eDIjMMw5OUh9LF/11LAE+sFzsiKDS0ALiH5y4uT/BIm8QICK3OU8xOdw8brQpIjSuNOk8FGhr3AUMAjPPKPeSF2AyInf7XTgoZIS6lkREIZ0vzUccN1471G&liveintent.com=13-3whu/zqPFbjZmcrjWUTuRmm9Hs49AkbGc+kQdqu5E9jXvR6ld0VfO19sMvsAex46/FtjbyxEi8tkXdh/QZKt/C8xWWWXM8ObJznKCWZTiYcLJQ==&bidswitch.net=70ec3ebb-e7fc-4bca-806c-7e53a8efe06c&liveintent.triplelift.com=1075601553087813430040&media.net=3782028751764519000V10&rubiconproject.com=M6VCOCYF-1C-3A8E&liveintent.indexexchange.com=Z6Xs1kt3udIAIoduAOzTIAAA&1278&openx.net=54b91979-23f5-4565-b16f-b33a236f2354&pubmatic.com=226BB3C0-C127-40F1-A3C8-BC72609FF0FB&sharethrough.com=8b234260-d68a-4af4-ab4c-a948d554f6b0&liveintent.sonobi.com=4f760ed7-11dc-432d-b807-aaec2eb8dfa1&linkedin.com=5377d9ff-4a6d-4976-a56a-d9bb23521152&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744929178124&bidder=ozone

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 931f61ad6bedcbae-LAX
access-control-allow-origin: https://elb.the-ozone-project.com
date: Thu, 17 Apr 2025 22:32:59 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 2C39
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D%24%7BUID%7D
https://elb.the-ozone-project.com/setuid?bidder=openx&uid=e2d270ba-4e5c-493b-a9d5-c1593d922d1a

0
696 B

98ms
95ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=openx&uid=e2d270ba-4e5c-493b-a9d5-c1593d922d1a
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931f61aee89bcbae-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=openx&uid=e2d270ba-4e5c-493b-a9d5-c1593d922d1a
pragma: no-cache
x-forwarded-for: 162.245.206.247
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 22:32:59 GMT
vary: Origin

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame EFED
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aAGBm9HM4WcAHw9OAM0IIgAA%262421&gpdr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1NNY
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc

43 B
576 B

542ms
125ms

Image
image/gif

2600:1f18:ed:550f:d4a0:5542:3220:6193
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1

Protocol

HTTP/1.1

Server

2600:1f18:ed:550f:d4a0:5542:3220:6193 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: ef9569be84ba328a
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc
Content-Length: 0
Date: Thu, 17 Apr 2025 22:33:00 GMT
trace-id: 24f88b6793d8ecee
Request-Time: 0
Connection: keep-alive

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame EFED
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aAGBm9HM4WcAHw9OAM0IIgAACXUAAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aAGBm9HM4WcAHw9OAM0IIgAACXUAAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

148ms
148ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aAGBm9HM4WcAHw9OAM0IIgAACXUAAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: D2RPNQATND075X4VT2BB
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aAGBm9HM4WcAHw9OAM0IIgAACXUAAAIB&gpp=&gpp_sid=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: XJBM4ZDQM2EXQMGK0FGY
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 17 Apr 2025 22:33:00 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame EFED 170 B
188 B 138ms
136ms Image
image/png 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aAGBm9HM4WcAHw9OAM0IIgAACXUAAAIB&gdpr_consent=&us_privacy=1NNY&gdpr=&gpp=&gpp_sid=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EFED
Redirect Chain

https://match.adsrvr.org/track/cmf/casale?us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZjNjNWJmNzctNWU4ZS00YzNlLThkOGYtODY5NjY5OTkwZWZj&gdpr=0&gdpr_consent=&ttd_tdid=f3c5bf77-5e8e-4c3e-8d8f-86966...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&google_error=15
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjNjNWJmNzctNWU4ZS00YzNlLThkOGYtODY5NjY5OTkwZWZj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc

170 B
188 B

134ms
134ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjNjNWJmNzctNWU4ZS00YzNlLThkOGYtODY5NjY5OTkwZWZj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc

Requested by

Protocol

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:33:00 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjNjNWJmNzctNWU4ZS00YzNlLThkOGYtODY5NjY5OTkwZWZj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f3c5bf77-5e8e-4c3e-8d8f-869669990efc
content-length: 423
date: Thu, 17 Apr 2025 22:33:00 GMT
server: Kestrel

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame EFED
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D&us_privacy=1NNY&gdpr=&gdpr_consent=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=f8d86801-819c-4d00-bb16-c9b15c4d1d25&gdpr=&gdpr_consent=

43 B
769 B

91ms
91ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=f8d86801-819c-4d00-bb16-c9b15c4d1d25&gdpr=&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=esrdRrzZE184K4UAmgRMx2BPRpKMmJ%2FdvBTi5xmtSbD4NL%2Fn%2FQtALzwk%2F%2F5sBehaMEbf0aSb7CCG5l4AdEEB9BZVW4DlXZPRytNSyXLMrsSnaYmVg%2FRzsDkHdX6M2ORuYw8%2F2hUyuBnpgA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931f61b07f4ecba7-LAX
content-length: 43
server: cloudflare

Redirect headers

X-Permitted-Cross-Domain-Policies: all
X-Content-Type-Options: nosniff
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Type: image/gif
Strict-Transport-Security: 31536000
Cache-Control: no-cache,no-store,must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=f8d86801-819c-4d00-bb16-c9b15c4d1d25&gdpr=&gdpr_consent=
Pragma: no-cache
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
Access-Control-Allow-Origin: *
Content-Length: 0
X-XSS-Protection: 0
Server: MT3 1797 8af0415 master ord ord-pixel-x48 config_version:"316"

GET
H2

200

ZMAwryCI
sync-tm.everesttech.net/ct/upi/pid/ Frame EFED
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&us_privacy=1NNY
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&us_privacy=1NNY&_test=aAGBmwALj8u80gAL

85 B
153 B

213ms
213ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&us_privacy=1NNY&_test=aAGBmwALj8u80gAL
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H2
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1744929180.299487,VS0,VE0
age: 579
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/png
x-served-by: cache-toj-leto2350046-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 2296

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&us_privacy=1NNY&_test=aAGBmwALj8u80gAL
x-timer: S1744929180.926432,VS0,VE87
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
x-served-by: cache-toj-leto2350046-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame EFED
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29&us_privacy=1NNY
https://c1.adform.net/serving/cookie/match?CC=1&party=29&us_privacy=1NNY
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=2773404983661518474&expiration=1746138780

43 B
765 B

77ms
76ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=2773404983661518474&expiration=1746138780
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C3%2FEMzcCF1lX%2BRYGo3p2aJsivisAcTTSKqFuasP7gfvcv5kc9EGtgDz8vkP0h5nf3F1ZbBAQuvhvMa0MGUd4CNZOrMjnlSAeOuehQY6%2FgwHHKPYaA5OwA3kNjXg8KGI%2FsC%2F751KYbxIHZw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931f61b1ab55cba7-LAX
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=2773404983661518474&expiration=1746138780
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame EFED
Redirect Chain

https://ad.turn.com/r/cs?pid=21&us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8613648871061682592

43 B
766 B

94ms
93ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8613648871061682592
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BJczNIFM%2BEHUgIas3s5gJC1d3xWelavu4ejsfc9DuTfcZz8MYiPnTz51TzsxA0VlvF0kc2dYQDIE7%2FISqxBttKXVpOEKjU5MU3CA3EQdlH0yUSh%2Fz39iC%2FNEHLAPTGXLXz1hHZq4uBnEwg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931f61af1a8ecba7-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8613648871061682592
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 22:33:01 GMT

GET
H3 200 setuid
prebid.intergient.com/ Frame EFED 0
994 B 148ms
145ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&us_privacy=1NNY&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aAGBm9HM4WcAHw9OAM0IIgAA%262421
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744929179&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=F8SJD8TP%2F9qWoGs8O2Gs94MBlj%2FglUJfSB6xlEm6BLg%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744929179&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=F8SJD8TP%2F9qWoGs8O2Gs94MBlj%2FglUJfSB6xlEm6BLg%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 931f61ae0d88f0e2-LAX
server: cloudflare

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 20B5 466 KB
94 KB 464ms
129ms Script
text/javascript 2600:1408:5400:23::b819:7f45
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AZ5mk9ajWu8ITKPdjOoV4WdMQ1DIaYWQy2rVUpcXzwUsiHQy-2MvawuBC4l0LPy-TSLBaMSIbtk542r_H_Y1PzdZkAhWhEGS5Xo7592WeZ4sEYyj0hsG3qeU5Bkb9dwbrA-9mj-VncGiXreI_4-aL5ERyz8Oekamx3RJ7w6zNrjAi7Xvl9DTDOlV94plqdIKKJsRogY4KLfjK0tg-oavfE7faXF5NdhwFyc_r81RDtYVMzHxFwFDL7g13la-vMOW781e0LDbOLOX_9rWQM5cx1e4vMFg&dbm_d=AKAmf-CvXzFTOrpsCGDTAPIU5Ae28NW9wV_TejY-tB6hza9_uE5UpKCnXt5ruHYufgev-yqf826C3s76ZBBAjJdtYMNZfwgAzkWzxi6L4_7BBjwkahV1Qb9aaMtTbZGGcMMKUg1zXvkglMg6xQdTwk6mobCXKwY2G5iEKiEfNubm7OMgHGf09RSvE7bJT3f7CBSq5KSTnX0ueE7SJetGOMSDQWkke7ZQmVYodPJl1T6sEpl2wrcY1avOnChdaiDs5hxewX9HYbyOMKJ1vQhtf1mRvxd6iRHsTWdQPrxziA4x9vTRvukHylwKEf_asue60NDKnLawd9nRd-H2QfSyI6GNk2StrrSlwtvMeXX9jpatZPeSB_fojKBFZk7Q_cpsV68aOu42jOVLoV-f-_vvh5Z1y7GqncsvwtMHOmLujxIxVYulZaru_sQCpEHwWUk7yytnQddKIXazaduex_ZRNTZYvozO8_XZOacYuqTAyrWWt_3_UdSyN31QwCpMigCU0hz58x5Z8ejIWNWPaQiSHBjQDvOZGzdD7YgDB5gi2-6nHuh9OGtITgASJjFqrrqi1CEHMIgaMQ1WI97HFoszQdH-UGK2kiCPNIB4NLhJPkPr8C_QlLgJ6fykVPPNjyoEqbVnZAa2uDUgTvK98WLmZTgy2oBULP9FZAjh1Qgz1veNZ7-VuMZzeHxcVik80CIwLCqAy6a2XD6gd2Ab7EEmkiaSIUzj6HBbaYwL4WAVYuK5e976vkiqCxEmlQjGHmkFXR5Q-enLzJZOKsSmm2B7IwNQOWUEi9VmTQx1t7XHJjLEIAYsRyt11mMvg5_mbf0Wb2RWEbb2sv_Xo2IePsSyfUYZY79cbHSSWnCoqAVIzJODi_MYcs-Pg9oRTOAKprP5XTPdJnxDFNH22_tUn6HAz2QzZxTLORM-Br59Z1iuIpXkJ8AMcIXZex4OhDONQqDgzPINA6xq79t8kNSnl653NBRtjhnrQfF0PpR7Rq8z3invv8Gl3eL-5IfxCT8D7XW0K8WRaKHU_7rUbKtL3jnSbuousg1NfE1FMMY7Vb3SkdyxIu3gHYcGhqRr21uaCNcIMADSJzYMQ_BGn0J5puM14NSl41CiUQIYkqUvlSRq6ab0mAI1LIeVKuMueKe5EnvZvUimonjRjjw1D-n4vKeOeq6TbR3ZAVJ4BMjBqBpRm0abowdF2V47dSm60FiK3xH3YgyXPG6XLc1t2cG5h8ZGsJ5u8KPFlz_3-QnN_27WXP4SZlxpJ8YRrwkx8jlrVt3lODCYXyzDCKzPQToSzG65DprFiDKwq-mlxJmQb7ymJQgBTVDJc_XsUmmA-D4EawfOu0cyE2K-ZvMzez1MM70ofztgyBeiCaMlZG1qJhkZCFBd1zF5hkZPFFUThyemTr74dqyKZDW5GT_mg4upYEHXXwe8NMSY_3V_h1lt0BrYKzXvsOljAW_3j4CWTiOjKkmGwF1oAxeZUn9Us2dS55qT53tlW8nchu1E4OPuuvw9hDSChvcvVkrWCjv56D0qfxYDBTG98eGOCVE0xEa9CG051Dcv9tpRQUeccnSy1VnCWggZUk8Tf2VSEy0h4KYECZ3JSDDKqSKvfaEWklFsGVBwkhbD1tpopIGAQ32garP72AncU5ekqz4A2DlrsxWqHbCblXOlMqryPHHGpIb3xGq0Puk9EOkZbvGX1KQdtghiHYnEd_oaKzxdyWtJhQWz1ixxWJT3E7ZVBsYOiqyXM0fEMcAeiEg7g9aTf7SIdOvL1pt0La0NTNkGsGN_QRix47a1vZFSKTQRaUNl6IsJRq4ru26uOcp8riEFam6a3WvHYHGejswMUXOM3-E7L2hMjL-zus2d3mX6JE3uVd2I6EUbec2Z1ih4I6-mFk4-d_-digkCpL1j9LBowOlV5byZiugsuEAP5FjBnPIg3dAvkAvY1lx97LtrrzVuNTHoP-bgDD9LXBhMV9qYxtOQGQ4hRGDO7JFPZw-rugzUOq2q3A6qe0kbUBqvjzqZVKN8FdtAXPOygDVrmV4AYSUuyyL2vSZ5ZFQ--5SQIcZtvbB6zrIGadTd2BHeePwX1ByJ4HTRwKoBgEZENRotZAHI2yogpVvB0UpJfRvtKh9SDC9sHjtA8ojFsgpzeRWz5GR2pj9uj3M8MrgyC0AUK2SLG94qzK1WenFR5KsAcjaNHe8neTT0VC0K1ddsX2H7y3CNdH-e2nMWJD5UDFeZsVSp41bml8ibCIZmD2BsC0YHE3xZ-x4h3w0Qou5zX3mJnMXpIy_NwhdZdVnHSl-TiC31DeHm1CTMGkUI_NptDzZrW3EoKQuPya3OuRqFnxrXaSiZQR8MuNOqI1rVYXkFSg1UOZ4vsFXWZBuDdUzMgj06Tm8b3zJDIcnRAwvUeboF1m5YceqcMwQV2V7b2ZedputREvF8LMLy4dsBdw60JBBRoY92fBm38BaX3Frow12-gHQZ7jKMZAayLITaLPLrhb-FjpO10WVTYgtFpBEcgbWfp-4kZF0GmWPg0QTqKsgIUjf155kgZtcqtTR4SLdx5othwqWIm2ho-Rg6Xfd0DeoxUvEvb4ZX7RTA_Sij3fbj6LnNMYQ7M7I8BthvUv8sPpcWhDgcEyZKGw6IngjOUPG1yMofENTwHdTwJJLvz2m84uPlEjheUORr-4l7efoX8C6VKbUrBCQRpLp7FouX1sRsWdVYkXxdJFG-x72n3sy4ozz2YeA6eZpja3Zhc_H7izVMrVclnWEYR3FdI_IAw_GsrNP7CZePrhzi7wNTEF4_qsIy8BFTB7RGqeToS4EvWLrO3p6mqf5YT6f_dZ2XHdAEc3kIrf43X63pDpKHIT25USrBJHqWtAMBsOMMyAnHQN1a75SZw4dMm-4uDlOZiChFLUgsVR_Ufw00xKntdJgD0dW_Zmc0G6bKKnL1i6r8I37wG2V9yf4TOLiKgjQVPKeljqE90bBA1eXL9jjRoJuTEI3-nYKv8Y61Ix0-ECj0gusMk1L_hLVd9kaXpTuG4v4hnS1der8kbaDcF629C-4LMkz25quYAf5u-1qv8qxb5xax3iV0GOKA7fRKJsaoKsMIWDQgnYzvNLeHsTY_w4NacMvrEjtlwyc0aksXFd-tvv8D_mG9v4sWUn8Za1fa7EwWHDkiCMr5-RFGJqU2fXNLi59Vl7jfdUcxATWuDoke1Sbz646JA5JIxoRnUXqhwXzNYXvkN7sYfctS5i-DsixgJaBF2j2vS5Gxog4BUvDldt1BtYlQnmNHrSjVJQ0NH0WCaz48Uv8Iq0lBAFT5tOV1CRwpfMPMhuKH5oUIGnjuWK43Pj9vJ9kHkcYGoG5FMwIGBtgZXX771H3yMD7lXAxvHc1P9AfXWFzB2m6qKHhC4ceo0sRQ_W1J13OGftdaFHXxe3WpijdUCLLukwuzcCq3_cSUFmWScg7zQ_YTh3PBKK6S0Mqfn0mX4nkSG_2upb2wRWvBBg5uL0HxOzEUMk8prTwEVxnl-uhg7s_wJhNxS9yYFnMO0eyV_qheOHk2oz5_NcYW_ooDrs8OFByyPUgnkd83t0ds7RSh9qmWUb5TDv4m7GMDQQo8Sy-lIVo5nKUnnkYMEidBZ3zIQZux7kYGx6D4T_JypPdsdKOCY7eybEQL6mlHRC80w6yMDUpeBa2ED72Q6gll-d0Qgilik7_QlwmIMEFPKhd7loS8Hs_O1TiQkj09M6MEv06QC4rjy4sKNBs4JN0If4FnfI5jV4aG4i5pwEA0RbpVugRnZ9vR5fNupWYMmGdPqueA42Mcy8RiOAT11DMADVHSc_xkaO4HSljYnqzqK4GgolK_SuWh5BGpolRqRD6TBENS0q8ctptTfpnFDvU8Msou1OIo-C1hliCHxSTxnU4eUyhxbBec-zWxN3hEbOV20OW_i582jRtI8CBO10RVTr1qO7QVxLHl1at2D0vHme20GrRdzxD9NAnVF3v4V9WGx4JvwDbWwDhlk8ADbbj2bGPZySCordiPaEqrGc_IwA0lV1q7VEZfUHnR2ASbkiuCpVQcColk-1ph1CuYS2c_CUmok3WAICmLNg6q-Cp1tbU7U_iwdY-Fj56Zw98vwD9EaFnyEO0sxLz1FIILGUhIRYqjTBUdpPPSKA&pr=8%3AB5A1AA3B851CB150&cid=CAQSjwIA2abss7WFiNAwDM_BhEKQIf6wvg8WSc0LEe8FChivv1NUN4L_MX3DTdvrD3yaV3or63I5_IDC_0oT7oHGmsb-b-ktFlIdMnGE6DcDS8LvxiW5weQHy4sbHZ61uf2hUXUtAkbG55o_c8vLR4DP4Vrp88vCI6IoZ0fmGoPCl8I9rHiSFY7l8aRQ3kYoYSK_ERak9W7bx9990fKRNs4tqmBWIZlT7Vu94Net2V4lCEcsAdljXRuW0DIie0GEXHQhl3BcCqr4l0UFnhvWcb0D9w9ZH-96JBvt2pXfGRaURovKQ0E9oKZYkwjoafplMcfz7-Tpy2HfYDrMT2xDWRRNzDE-wV9Pa3YrQc06ZsV3mlJoGAE&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&ct=76&iif=1&cor=15384982277677361000&adk=1627501012&idt=259&cac=0&dtd=130
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:5400:23::b819:7f45 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 0f0a6f26be4c066c25508390dc94b7f838bcab7bc2e81a8f76ee2d6aea63b6de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "6047601a5aedaae7e97ce092b87b1e11"
Connection: keep-alive
Expires: Thu, 17 Apr 2025 22:48:00 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 96007
Date: Thu, 17 Apr 2025 22:33:00 GMT
Last-Modified: Thu, 17 Apr 2025 05:24:12 GMT
Content-Type: text/javascript

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250415/r20110914/ Frame 20B5 28 KB
10 KB 121ms
121ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250415/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AZ5mk9ajWu8ITKPdjOoV4WdMQ1DIaYWQy2rVUpcXzwUsiHQy-2MvawuBC4l0LPy-TSLBaMSIbtk542r_H_Y1PzdZkAhWhEGS5Xo7592WeZ4sEYyj0hsG3qeU5Bkb9dwbrA-9mj-VncGiXreI_4-aL5ERyz8Oekamx3RJ7w6zNrjAi7Xvl9DTDOlV94plqdIKKJsRogY4KLfjK0tg-oavfE7faXF5NdhwFyc_r81RDtYVMzHxFwFDL7g13la-vMOW781e0LDbOLOX_9rWQM5cx1e4vMFg&dbm_d=AKAmf-CvXzFTOrpsCGDTAPIU5Ae28NW9wV_TejY-tB6hza9_uE5UpKCnXt5ruHYufgev-yqf826C3s76ZBBAjJdtYMNZfwgAzkWzxi6L4_7BBjwkahV1Qb9aaMtTbZGGcMMKUg1zXvkglMg6xQdTwk6mobCXKwY2G5iEKiEfNubm7OMgHGf09RSvE7bJT3f7CBSq5KSTnX0ueE7SJetGOMSDQWkke7ZQmVYodPJl1T6sEpl2wrcY1avOnChdaiDs5hxewX9HYbyOMKJ1vQhtf1mRvxd6iRHsTWdQPrxziA4x9vTRvukHylwKEf_asue60NDKnLawd9nRd-H2QfSyI6GNk2StrrSlwtvMeXX9jpatZPeSB_fojKBFZk7Q_cpsV68aOu42jOVLoV-f-_vvh5Z1y7GqncsvwtMHOmLujxIxVYulZaru_sQCpEHwWUk7yytnQddKIXazaduex_ZRNTZYvozO8_XZOacYuqTAyrWWt_3_UdSyN31QwCpMigCU0hz58x5Z8ejIWNWPaQiSHBjQDvOZGzdD7YgDB5gi2-6nHuh9OGtITgASJjFqrrqi1CEHMIgaMQ1WI97HFoszQdH-UGK2kiCPNIB4NLhJPkPr8C_QlLgJ6fykVPPNjyoEqbVnZAa2uDUgTvK98WLmZTgy2oBULP9FZAjh1Qgz1veNZ7-VuMZzeHxcVik80CIwLCqAy6a2XD6gd2Ab7EEmkiaSIUzj6HBbaYwL4WAVYuK5e976vkiqCxEmlQjGHmkFXR5Q-enLzJZOKsSmm2B7IwNQOWUEi9VmTQx1t7XHJjLEIAYsRyt11mMvg5_mbf0Wb2RWEbb2sv_Xo2IePsSyfUYZY79cbHSSWnCoqAVIzJODi_MYcs-Pg9oRTOAKprP5XTPdJnxDFNH22_tUn6HAz2QzZxTLORM-Br59Z1iuIpXkJ8AMcIXZex4OhDONQqDgzPINA6xq79t8kNSnl653NBRtjhnrQfF0PpR7Rq8z3invv8Gl3eL-5IfxCT8D7XW0K8WRaKHU_7rUbKtL3jnSbuousg1NfE1FMMY7Vb3SkdyxIu3gHYcGhqRr21uaCNcIMADSJzYMQ_BGn0J5puM14NSl41CiUQIYkqUvlSRq6ab0mAI1LIeVKuMueKe5EnvZvUimonjRjjw1D-n4vKeOeq6TbR3ZAVJ4BMjBqBpRm0abowdF2V47dSm60FiK3xH3YgyXPG6XLc1t2cG5h8ZGsJ5u8KPFlz_3-QnN_27WXP4SZlxpJ8YRrwkx8jlrVt3lODCYXyzDCKzPQToSzG65DprFiDKwq-mlxJmQb7ymJQgBTVDJc_XsUmmA-D4EawfOu0cyE2K-ZvMzez1MM70ofztgyBeiCaMlZG1qJhkZCFBd1zF5hkZPFFUThyemTr74dqyKZDW5GT_mg4upYEHXXwe8NMSY_3V_h1lt0BrYKzXvsOljAW_3j4CWTiOjKkmGwF1oAxeZUn9Us2dS55qT53tlW8nchu1E4OPuuvw9hDSChvcvVkrWCjv56D0qfxYDBTG98eGOCVE0xEa9CG051Dcv9tpRQUeccnSy1VnCWggZUk8Tf2VSEy0h4KYECZ3JSDDKqSKvfaEWklFsGVBwkhbD1tpopIGAQ32garP72AncU5ekqz4A2DlrsxWqHbCblXOlMqryPHHGpIb3xGq0Puk9EOkZbvGX1KQdtghiHYnEd_oaKzxdyWtJhQWz1ixxWJT3E7ZVBsYOiqyXM0fEMcAeiEg7g9aTf7SIdOvL1pt0La0NTNkGsGN_QRix47a1vZFSKTQRaUNl6IsJRq4ru26uOcp8riEFam6a3WvHYHGejswMUXOM3-E7L2hMjL-zus2d3mX6JE3uVd2I6EUbec2Z1ih4I6-mFk4-d_-digkCpL1j9LBowOlV5byZiugsuEAP5FjBnPIg3dAvkAvY1lx97LtrrzVuNTHoP-bgDD9LXBhMV9qYxtOQGQ4hRGDO7JFPZw-rugzUOq2q3A6qe0kbUBqvjzqZVKN8FdtAXPOygDVrmV4AYSUuyyL2vSZ5ZFQ--5SQIcZtvbB6zrIGadTd2BHeePwX1ByJ4HTRwKoBgEZENRotZAHI2yogpVvB0UpJfRvtKh9SDC9sHjtA8ojFsgpzeRWz5GR2pj9uj3M8MrgyC0AUK2SLG94qzK1WenFR5KsAcjaNHe8neTT0VC0K1ddsX2H7y3CNdH-e2nMWJD5UDFeZsVSp41bml8ibCIZmD2BsC0YHE3xZ-x4h3w0Qou5zX3mJnMXpIy_NwhdZdVnHSl-TiC31DeHm1CTMGkUI_NptDzZrW3EoKQuPya3OuRqFnxrXaSiZQR8MuNOqI1rVYXkFSg1UOZ4vsFXWZBuDdUzMgj06Tm8b3zJDIcnRAwvUeboF1m5YceqcMwQV2V7b2ZedputREvF8LMLy4dsBdw60JBBRoY92fBm38BaX3Frow12-gHQZ7jKMZAayLITaLPLrhb-FjpO10WVTYgtFpBEcgbWfp-4kZF0GmWPg0QTqKsgIUjf155kgZtcqtTR4SLdx5othwqWIm2ho-Rg6Xfd0DeoxUvEvb4ZX7RTA_Sij3fbj6LnNMYQ7M7I8BthvUv8sPpcWhDgcEyZKGw6IngjOUPG1yMofENTwHdTwJJLvz2m84uPlEjheUORr-4l7efoX8C6VKbUrBCQRpLp7FouX1sRsWdVYkXxdJFG-x72n3sy4ozz2YeA6eZpja3Zhc_H7izVMrVclnWEYR3FdI_IAw_GsrNP7CZePrhzi7wNTEF4_qsIy8BFTB7RGqeToS4EvWLrO3p6mqf5YT6f_dZ2XHdAEc3kIrf43X63pDpKHIT25USrBJHqWtAMBsOMMyAnHQN1a75SZw4dMm-4uDlOZiChFLUgsVR_Ufw00xKntdJgD0dW_Zmc0G6bKKnL1i6r8I37wG2V9yf4TOLiKgjQVPKeljqE90bBA1eXL9jjRoJuTEI3-nYKv8Y61Ix0-ECj0gusMk1L_hLVd9kaXpTuG4v4hnS1der8kbaDcF629C-4LMkz25quYAf5u-1qv8qxb5xax3iV0GOKA7fRKJsaoKsMIWDQgnYzvNLeHsTY_w4NacMvrEjtlwyc0aksXFd-tvv8D_mG9v4sWUn8Za1fa7EwWHDkiCMr5-RFGJqU2fXNLi59Vl7jfdUcxATWuDoke1Sbz646JA5JIxoRnUXqhwXzNYXvkN7sYfctS5i-DsixgJaBF2j2vS5Gxog4BUvDldt1BtYlQnmNHrSjVJQ0NH0WCaz48Uv8Iq0lBAFT5tOV1CRwpfMPMhuKH5oUIGnjuWK43Pj9vJ9kHkcYGoG5FMwIGBtgZXX771H3yMD7lXAxvHc1P9AfXWFzB2m6qKHhC4ceo0sRQ_W1J13OGftdaFHXxe3WpijdUCLLukwuzcCq3_cSUFmWScg7zQ_YTh3PBKK6S0Mqfn0mX4nkSG_2upb2wRWvBBg5uL0HxOzEUMk8prTwEVxnl-uhg7s_wJhNxS9yYFnMO0eyV_qheOHk2oz5_NcYW_ooDrs8OFByyPUgnkd83t0ds7RSh9qmWUb5TDv4m7GMDQQo8Sy-lIVo5nKUnnkYMEidBZ3zIQZux7kYGx6D4T_JypPdsdKOCY7eybEQL6mlHRC80w6yMDUpeBa2ED72Q6gll-d0Qgilik7_QlwmIMEFPKhd7loS8Hs_O1TiQkj09M6MEv06QC4rjy4sKNBs4JN0If4FnfI5jV4aG4i5pwEA0RbpVugRnZ9vR5fNupWYMmGdPqueA42Mcy8RiOAT11DMADVHSc_xkaO4HSljYnqzqK4GgolK_SuWh5BGpolRqRD6TBENS0q8ctptTfpnFDvU8Msou1OIo-C1hliCHxSTxnU4eUyhxbBec-zWxN3hEbOV20OW_i582jRtI8CBO10RVTr1qO7QVxLHl1at2D0vHme20GrRdzxD9NAnVF3v4V9WGx4JvwDbWwDhlk8ADbbj2bGPZySCordiPaEqrGc_IwA0lV1q7VEZfUHnR2ASbkiuCpVQcColk-1ph1CuYS2c_CUmok3WAICmLNg6q-Cp1tbU7U_iwdY-Fj56Zw98vwD9EaFnyEO0sxLz1FIILGUhIRYqjTBUdpPPSKA&pr=8%3AB5A1AA3B851CB150&cid=CAQSjwIA2abss7WFiNAwDM_BhEKQIf6wvg8WSc0LEe8FChivv1NUN4L_MX3DTdvrD3yaV3or63I5_IDC_0oT7oHGmsb-b-ktFlIdMnGE6DcDS8LvxiW5weQHy4sbHZ61uf2hUXUtAkbG55o_c8vLR4DP4Vrp88vCI6IoZ0fmGoPCl8I9rHiSFY7l8aRQ3kYoYSK_ERak9W7bx9990fKRNs4tqmBWIZlT7Vu94Net2V4lCEcsAdljXRuW0DIie0GEXHQhl3BcCqr4l0UFnhvWcb0D9w9ZH-96JBvt2pXfGRaURovKQ0E9oKZYkwjoafplMcfz7-Tpy2HfYDrMT2xDWRRNzDE-wV9Pa3YrQc06ZsV3mlJoGAE&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&ct=76&iif=1&cor=15384982277677361000&adk=1627501012&idt=259&cac=0&dtd=130

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

261a186cd1fc151c1e2b9384debb7d79fbe6c09f9291e9856f6901d16409208e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 6888123906427899671
age: 12445
x-content-type-options: nosniff
expires: Thu, 01 May 2025 19:05:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 19:05:34 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10668
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 20B5 221 KB
68 KB 123ms
122ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 18003062906086184080
age: 2586
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:49:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 21:49:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69570
x-xss-protection: 0
server: cafe

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250415/r20110914/elements/html/ Frame 20B5 12 KB
4 KB 138ms
137ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250415/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ec0d4a8b73c1b311d91ec21907b35ed43be697059740b70571f5a8abe40a96a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8593911155552589720
age: 12444
x-content-type-options: nosniff
expires: Thu, 01 May 2025 19:05:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 19:05:35 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 4395
x-xss-protection: 0
server: cafe

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 20B5 0
0 146ms
146ms Fetch
image/png 142.251.16.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvWXD_dJ8lBPolKV4FXs01xYH90ZKZXOghpMU83-v2oB_k_Jv_T4TfnKkF6Ct9zfhlBHr8gSqVNaaDLuHFut9JRwpY2py1_4yITGiKHDPShkzcoNnsbDQ8ImUZ5w8ygrIkcqM043tBrcK4cUMC1hOk-xzLU9R0Orvzp4y2fx7L5btPKwS0LJfPKPcf_ckeDXu0GPbt7IvCnqHSQBXFRYZJJUU_vuIdG551gw5kMD5W3WcuwcGbGh-TfZJrXl0_kT0ER5yx6XjZLBVuh_SIwQADaMiIYRaV-LjIifCA3lPcgISdK3z4A336F2JiJ1m6g5INp4CRLWB3rp7UF7YPpdEOZPYTgcu7A5ZAI2FnacbjgPJDULyVAFEJ--gb6DertfW1tZTi86mEgTW3HRkIACBiDoL7i95MK1LBYSGnSWkvN46iXWhvIGCeqsdUwxDO3jsupBJizD2NnVxjTIosk_13vvD29DApViyMb-AmEIpb-jV6cQsrbKoDZTWfEEW3GF8tuC6Aa8Zw9ZVwAivS6PX5igYRxgcQ4qqaXd9WrJduc42zzlnANQOXb6x0v8AU-7vD4YtMz-TOESKR4oSA1ulIQMzuXow1em0TD1WYXe0oTVygp5qLMmv7PgrrqtmCf92d79vAAL29wIE75LdivTM-j_KY3Ktjl8L8xIsqOScr6Fyd44r3ph-6Ybv23VTO38Pw4PLvKjLVbvAhDq4bwkqSzBQvLwxfQJnlXi1E-aRDTagvUs0qFSsoFzIUOtXImWvg8y9Oh9ABT_2HlS4Bcue_hTtFOxsaUoyOjaw1ho6I_hPaHdRdK0dqvDul-uN7m32hBi1viDusCZpAaBNWAs8sdTdFOcKAg_RBQurHz8GLxCsUR4RioGh9hL44VLmDnuPJvtWa49e-93wnHwZ6P-KeOhLq78LczT4D65t05zwb4gCSDz8s4Vgs1D5iJ4W3NLucn6QXr67xYKVuom-X_q_PiLj6iACOXbkPxBOTvDE8nKs2VnYrmJdLN0cTITwV9fx-EpOVqgvcFTCQvcS1mEOVGTHzuLdECMLAP-e00BhWACgSJpADaqtLj-NRrZptrZ3XPzCF7Yg-8M7CDLkMHYNBKhc7OEsrgFHJfHkZtzejF8T7epgEeuOAKwd4qKSd9-90GVWOY-Wij66hFKLIGYIWpkoJLC2S1sdb-D2dRvqUi3W7AM2j4Ku_n48Vog8qi4oQvYHvJW9N0JyMaiXJz3HpvOQcXu0fOJPiv6PczRuRpqksFZNbcAq1pYKO-FbhqV_f-JOq3uo0-9AKZTs8pncBR0Cv451oyhJik8uSqRLNrwPyBCyuHqZOpzBsrcharNg4fAWBiUD_dFH9ktThas0IfZF7xWu-9Eeh0ElHTgeMeMtRvKbpEKuhzgHzCXhQ5k591ej4IoBMDwaISxDGh7-o0F1pT0eLDjFkU9wVaW-zyk-YINHLfTBa0mKP4L2ZoGxC-3LsSD4DlHDaQKVipgBYwq9zZ2geICibm3lW--LJlE9sXTIt-lVxrjH4hKlbVpTOZ6mXr28xabYM_tgK6&sai=AMfl-YSBBaFw-Crwmq-cz3w-LFHbNxZpsrh3iCzO2STjRBOvUevp8b2K08_iqFR6zl719HBLzBr703GscxEc1bAzxRhK_2yEj5hgMMtoENfW_BawvuuwQGoLGGu3BXwHVFX6uVF_01peBwc-8LiTLv4B7Myn4HGx_k35L_j95uIGC9FkNZ9B40w7rmxw9Wm9Nurr7Dn_ZgER4auXOmfCobecLMiHv_dlI3A60RZfh6gidwK_BAMBRVsIyBhjKSIb_4kWpjkxewhVOFePekeU1mzy0MgVaE3z_nGCLmlj2TwKwMNuoHMfK_qthYmZItOUbgYG2K-nAzQc94_O2b2hjmmRoaZvNpyrrWLJrxgEakEzayPn-v2_EC3HOrLnAlrZuYegPeJIRS6iGPUxI6e9D4oTP710uMyXWNGbVV0IqBDf7J1HFxbq6RdHHAKsCjhzFNtY38woRQmtaMD2KpQYMa-n-NKVE8upLsIWTfGfTh-EZJBtPImjg7JN2oIroNcQOKmt9rPdCPKfJHShheGKGAcNMeFkB3SDwEfw4Mr847Htj6bG4YAomIiomG7GKcCQqY2FqxL5qYCUjG832SBNegvosjwtF8_8XpOTSQ1PNDQ301DaVBdv_bC54q1h6D7LKy42sc-sAqNIs8wFpuQ6ks226nnnfxnCTwjqXQr8WO7vn5cdzx8GtvOk3e8DqOxOFvGDgJ-2sQM5HKa26_xciHPnDIKqcX879rOkH-0LvFiFNozqTzM-C87cRcD7FEt3dxbzePEIWt94rorTD303o2EySiHD-kH17tPJ25QKQiEj5KB_cNa8NyD4-9ePI4jHMMtF_fCEIzLozPrXGzEVDGY0OTLtowm-2efIaTcjPjl9RhHbopenMgv2QLKQqnws3H2Ckp50IyOGruQsAKWqFBC0rKSkTob1FCStn4luZbYDZCwwRbVF&sig=Cg0ArKJSzLjX57QnL5ylEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9iZXN0YnV5LmNvbQ&pr=8:B5A1AA3B851CB150&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=2&dett=2&cstd=0&cisv=r20250415.36827&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:32:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"908824240":"0x41b2a0a749177250000000000000000","908824241":"0x99f07986506951e70000000000000000","908824242":"0xd7f974e182b1d1c50000000000000000"},"debug_key":"5531258505992066514","debug_reporting":true,"destination":["https://bestbuy.com","https://debugconversiondomain1.com","https://debugconversiondomain2.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["1799868","9672931"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["4448269"]},"max_event_level_reports":2,"priority":"0","source_event_id":"17140265489557028779"}
server: cafe

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame AECA 269 B
379 B 163ms
162ms Document
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&us_privacy=1NNY&geo=na&co=us
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 17 Apr 2025 22:32:59 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
0 130ms
129ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
0 132ms
132ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
0 250ms
130ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 20B5 0
0 134ms
133ms Fetch
image/gif 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuhaZDDHtAA1nkdFuQaib8VfqgK-csRWLeFjkbLct4HQWKKdGvEmGWJYSN60-gvqnBx-oXt3hVyDeXGmCzdMYWGFEc-rXOoLMCds1ytrUkDD5G1gqpYnMAA5HJ349WZiQWKoY0pnuFY0nHNvoKQ54hTXlqYOWDJgv2YUfku4AaTGLd7NTfjtFnv2xeHJJaz1JuhDgWArWCuoGrYeRLL1JZI7xXNlvYHC0sEO4gWpDxygW2174Jo3B4WZnj3b5mysP9gbh13JtNL40kyFPlztU9tamnfkHPdFhUa4k6u99GLKwoCi-oT8NAvwCqVIpdCJ5GW_QNtco93IxVKxpwBng-WFpVAZ7I9J-iXTdzZhe0NLVtlHwor9J_QI1L0t2a6fwpQc-A9OIpHarGIh_tA7kioOC91YsdUFkteWLTFqrLxtHcqgLsOypjJcnxFSrzsZVX_EH12ecrCKfPCWg3KA4zwo8x1tDMk5DBgyKxS4jAlPW45Ub_QbAoaDPYx-UN0mwOQPrLV242vNQVlxksUeVFDT8OkE0P9v7H-vZ2GYX5hKYjETY67wRyARhV9Pe370dt8XOhu7T0zPlJkk3RNMKUjG9turNw&sai=AMfl-YRIXts4aahT3QghL_Yn1eN9NXQ1iMjs2wkehBcrQXnMOmqEEW_Y_cy6ntdxZQ6p51886NpKSsIEj5a4Glqqev57bVue-w5VZm8Ce6gUfI-_IMMlRdonthTPRr8&sig=Cg0ArKJSzLOXrXODrnzJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 22:32:59 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 20B5 215 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31d42874a1f8dcf11b049fe046cd5c73b8f4117673e68ddf409c839b839460c8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame CC27
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=

35 B
590 B

128ms
126ms

Document
image/gif

185.167.164.53
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.53 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 17 Apr 2025 22:33:00 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 10C6
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=07C2998F-9570-4947-B846-33E4E30B41D5&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=07C2998F-9570-4947-B846-33E4E30B41D5&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

146ms
146ms

Document
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=07C2998F-9570-4947-B846-33E4E30B41D5&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-70-147-192.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 17 Apr 2025 22:33:00 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: KTSZ59VFPMMQ1JRZ2Q6Q

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 17 Apr 2025 22:33:00 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=07C2998F-9570-4947-B846-33E4E30B41D5&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: YPFBPDRXCTXWC16P3ZTW

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame FD74
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8603902614458982697&gdpr=0&gdpr_consent=

42 B
447 B

319ms
119ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8603902614458982697&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: ae9bff3a-6518-4a70-a025-30facad05a28
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:32:59 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8603902614458982697&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.247; 162.245.206.247; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame FBF1 0
337 B 402ms
129ms Document
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame D381
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=kfFGjU30WylW_pXcqzTaB6L1zvc&gdpr=0&gdpr_consent=

42 B
378 B

387ms
120ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=kfFGjU30WylW_pXcqzTaB6L1zvc&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:32:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Thu, 17 Apr 2025 22:32:59 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=kfFGjU30WylW_pXcqzTaB6L1zvc&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame EABF
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2809753634879569878

42 B
195 B

129ms
128ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2809753634879569878
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Thu, 17 Apr 2025 22:33:00 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2809753634879569878
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame B8A4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
149 B

212ms
212ms

Document
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAGBmwAAAG48DwA_
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 578
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 17 Apr 2025 22:33:00 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 2295
x-robots-tag: noindex
x-served-by: cache-toj-leto2350046-TOJ
x-timer: S1744929180.256719,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAGBmwAAAG48DwA_
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-toj-leto2350046-TOJ
x-timer: S1744929180.956880,VS0,VE86

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame CD21
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEVDRVN1FBd01BQUJ3LVVheVJpdw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AADT4U7QAwMAABw-UayRiw&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1863162367110441280&gdpr=0&gdpr_consent=

43 B
433 B

123ms
122ms

Document
image/gif

52.70.147.192
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1863162367110441280&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.70.147.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Thu, 17 Apr 2025 22:33:01 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

cache-control: no-cache,no-store
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1863162367110441280&gdpr=0&gdpr_consent=
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma: no-cache

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A82D
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://p.rfihub.com/cm?in=1&pub=20513&ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=2810316584722766590&expires=30&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
202 B

121ms
120ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=f11d1a4b-a1d7-43da-97ea-ed3f9bfab27f&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 4B84
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=13cd2da1-ee08-488a-8c49-668077c8f33c&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=07C2998F-9570-4947-B846-33E4E30B41D5

42 B
489 B

123ms
123ms

Document
image/gif

44.216.47.253
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=07C2998F-9570-4947-B846-33E4E30B41D5
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.216.47.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-47-253.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Thu, 17 Apr 2025 22:33:00 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 17 Apr 2025 22:32:59 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=07C2998F-9570-4947-B846-33E4E30B41D5
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 2C87 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 93C5
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=LaeQmiOumcg2rcGcL6eNnir6ks82_pWcK_paA-qV

42 B
331 B

129ms
129ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=LaeQmiOumcg2rcGcL6eNnir6ks82_pWcK_paA-qV
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-store, proxy-revalidate
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=LaeQmiOumcg2rcGcL6eNnir6ks82_pWcK_paA-qV
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B8AE
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=eafd39f2-1bdb-11f0-bb05-75cd9d0803a9

42 B
244 B

121ms
121ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=eafd39f2-1bdb-11f0-bb05-75cd9d0803a9
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Thu, 17 Apr 2025 22:33:00 GMT
Expires: Thu, 23 Sep 2004 17:42:04 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=eafd39f2-1bdb-11f0-bb05-75cd9d0803a9
P3P: CP="NOI OTC OTP OUR NOR"
Pragma: no-cache
cache-control: max-age=0, private, must-revalidate
vary: accept-encoding

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9229
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw

42 B
95 B

145ms
121ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:32:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 931f61afeb732f41-LAX
content-type: text/html
date: Thu, 17 Apr 2025 22:33:00 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-function: 209
x-reuse-index: 3391

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C9A6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3ffd6801-819c-4100-a529-22fce4a4be3f&gdpr=0&gdpr_consent=

42 B
209 B

147ms
122ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3ffd6801-819c-4100-a529-22fce4a4be3f&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 17 Apr 2025 22:33:00 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Referrer-Policy: strict-origin
Server: MT3 1797 8af0415 master ord ord-pixel-x33 config_version:"316"
Strict-Transport-Security: 31536000
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
X-XSS-Protection: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3ffd6801-819c-4100-a529-22fce4a4be3f&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame DB89
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=OP2VM8ViZEYq1hXjb1Smz99u65nSesQfpZ4DWK36iR4&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1N...

42 B
349 B

121ms
120ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=OP2VM8ViZEYq1hXjb1Smz99u65nSesQfpZ4DWK36iR4&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:32:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT Thu, 17 Apr 2025 22:33:00 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=OP2VM8ViZEYq1hXjb1Smz99u65nSesQfpZ4DWK36iR4&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame D32A
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUa3ef4cbb1a184555b4e3138379ce7fc7

42 B
314 B

128ms
128ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUa3ef4cbb1a184555b4e3138379ce7fc7
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUa3ef4cbb1a184555b4e3138379ce7fc7
pragma: no-cache
server: Tengine

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame 7316 0
181 B 404ms
125ms Document
text/html 143.244.222.249
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.244.222.249 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Thu, 17 Apr 2025 22:32:59 GMT

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 31E1
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=07C2998F-9570-4947-B846-33E4E30B41D5
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8eca8013-3a84-4cb2-9d20-81bf85528e4f

42 B
318 B

113ms
110ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8eca8013-3a84-4cb2-9d20-81bf85528e4f
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8eca8013-3a84-4cb2-9d20-81bf85528e4f
pragma: no-cache
x-forwarded-for: 162.245.206.247
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 31E1
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=724483397c6555b4f60c1886335d092e&gdpr=0
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-sstodiRE2pQaIVLsqyNnnAOyfL0LlzMQ8Q--~A&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&icm&gdpr=0&gdpr_consent=&cver
https://spl.zeotap.com/?zdid=1332&zcluid=38aa98c330ad07f2
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=2a34fb8e-4d8d-4422-499a-47619bba6703&reqId=7afba0db-057b-480e-5a2d-f868cfde5c80&zclui...
https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=2a34fb8e-4d8d-4422-499a-47619bba6703&reqId=7afba0db-057b-480e-5a2d-f868cfde5c80&zcluid=38aa98c330a...

95 B
188 B

226ms
224ms

Image
image/png

2606:4700:10::ac43:28ad
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=2a34fb8e-4d8d-4422-499a-47619bba6703&reqId=7afba0db-057b-480e-5a2d-f868cfde5c80&zcluid=38aa98c330ad07f2&zdid=1332&google_error=15

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700:10::ac43:28ad , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 931f61c26aed2eb5-LAX
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Thu, 17 Apr 2025 22:33:03 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=2a34fb8e-4d8d-4422-499a-47619bba6703&reqId=7afba0db-057b-480e-5a2d-f868cfde5c80&zcluid=38aa98c330ad07f2&zdid=1332&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
date: Thu, 17 Apr 2025 22:33:03 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame 31E1
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=07C2998F-9570-4947-B846-33E4E30B41D5&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=07C2998F-9570-4947-B846-33E4E30B41D5&sInitiator=external&gdpr=0&gdpr_consent=

42 B
603 B

137ms
137ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=07C2998F-9570-4947-B846-33E4E30B41D5&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 1
Pragma: no-cache
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Length: 42
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=07C2998F-9570-4947-B846-33E4E30B41D5&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 5
Pragma: no-cache
Connection: Keep-Alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Length: 0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 31E1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=B8KZj5VwSUe4RjPk4wtB1Q%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
20 KB

119ms
116ms

Image
text/html

23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=151497
content-encoding: gzip
expires: Sat, 19 Apr 2025 16:37:57 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 17 Apr 2025 22:33:00 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
113 B

131ms
128ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C5062F99258C4BA6ADD13CB35D55EB5A

42 B
248 B

129ms
128ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C5062F99258C4BA6ADD13CB35D55EB5A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C5062F99258C4BA6ADD13CB35D55EB5A
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 16 Apr 2025 22:33:00 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=

42 B
394 B

397ms
123ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:32:58 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=
content-length: 355
date: Thu, 17 Apr 2025 22:32:59 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=07C2998F-9570-4947-B846-33E4E30B41D5&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-EjzIod9E2uWaT_clKd8K92PVCINfFIU-~A&gdpr=0

0
260 B

394ms
129ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-EjzIod9E2uWaT_clKd8K92PVCINfFIU-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:33:00 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-EjzIod9E2uWaT_clKd8K92PVCINfFIU-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: text/html
server: ATS

GET
H2 200 07C2998F-9570-4947-B846-33E4E30B41D5
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 31E1 43 B
518 B 143ms
127ms Image
image/gif 2600:1f18:4e9:5a01:2ac1:5fb5:bbfc:3fe6
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/07C2998F-9570-4947-B846-33E4E30B41D5?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:2ac1:5fb5:bbfc:3fe6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=20050a63-6b49-4c32-9e29-0a4c5c706bea&gdpr=0&gdpr_consent=

1 B
254 B

120ms
120ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=20050a63-6b49-4c32-9e29-0a4c5c706bea&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:32:59 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: cde3e000-f01d-4164-9989-38e9fafb7bad
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=20050a63-6b49-4c32-9e29-0a4c5c706bea&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=055222fe-2f09-4c05-8cf1-21a72f3e6bde-6801819c-5553&gdpr=0&gdpr_consent=

42 B
306 B

131ms
128ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=055222fe-2f09-4c05-8cf1-21a72f3e6bde-6801819c-5553&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=055222fe-2f09-4c05-8cf1-21a72f3e6bde-6801819c-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
server: A

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=3f0aac512f0612ca&is_secure=true&networkId=17100&version=1&nuid=07C2998F-9570-4947-B846-33E4E30B41D5&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGWDHE-SHjyAJrrgeEAQEBAQEBAQCXRONKeQEBAQEBAQEB&expiration=1745015580&nuid=07C2998F-9570-49...

42 B
373 B

122ms
121ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGWDHE-SHjyAJrrgeEAQEBAQEBAQCXRONKeQEBAQEBAQEB&expiration=1745015580&nuid=07C2998F-9570-4947-B846-33E4E30B41D5&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGWDHE-SHjyAJrrgeEAQEBAQEBAQCXRONKeQEBAQEBAQEB&expiration=1745015580&nuid=07C2998F-9570-4947-B846-33E4E30B41D5&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
pragma: no-cache
server: nginx

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 31E1 0
35 B 408ms
124ms Image
text/plain 18.210.251.177
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.251.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-251-177.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 17 Apr 2025 22:33:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8613648871061682592&gdpr=0&gdpr_consent=&us_privacy=

1 B
321 B

133ms
129ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8613648871061682592&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8613648871061682592&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 17 Apr 2025 22:33:15 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 31E1
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33646_126EF5576_5E4CEFBD&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

130ms
129ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-427933980; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Strict-Transport-Security: max-age=-427933980; includeSubDomains
Expires: -1
Cache-Control: no-cache
Content-Length: 43
Pragma: no-cache
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 16:28:15 GMT
server: nginx

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 31E1
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=4500028475502074209

42 B
241 B

121ms
121ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=4500028475502074209
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=4500028475502074209
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
0 133ms
133ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:32:59 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
0 260ms
133ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame ACB5 43 KB
11 KB 147ms
146ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 3329370cbccd06d1071d3ad29343fab3e0dd74cfbb27111092db04bb5b3408c2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=58024
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:40:03 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Thu, 17 Apr 2025 22:32:59 GMT
last-modified: Thu, 17 Apr 2025 14:40:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B9B6 43 KB
0 141ms
140ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 3329370cbccd06d1071d3ad29343fab3e0dd74cfbb27111092db04bb5b3408c2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=58024
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:40:03 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Thu, 17 Apr 2025 22:32:59 GMT
last-modified: Thu, 17 Apr 2025 14:40:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 852 B
1 KB 221ms
218ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

7390de9b7ceb608ed71c6bdbf9f8db9113412becdd702aaf7668ed362b3dc34a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: application/json
vary: Origin

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame AECA 43 KB
0 106ms
106ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&us_privacy=1NNY&geo=na&co=us
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 3329370cbccd06d1071d3ad29343fab3e0dd74cfbb27111092db04bb5b3408c2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?&us_privacy=1NNY&geo=na&co=us

Response headers

cache-control: max-age=58024
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:40:03 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Thu, 17 Apr 2025 22:32:59 GMT
last-modified: Thu, 17 Apr 2025 14:40:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 104ms
100ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 931f61afbdaa5397-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 109ms
108ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 931f61aefae65397-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
server: cloudflare
vary: Origin

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame B1DE 0
923 B 130ms
128ms Script
text/html 68.67.181.230
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.230 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.247; 162.245.206.247; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 5acde8b5-3841-4fee-a290-7c5b3a5aaa83
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 22:33:00 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 20B5 0
0 133ms
131ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 event
p.ad.gt/api/v1/ Frame 09D1 0
140 B 232ms
105ms Ping
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 931f61b18c5fef78-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 262ms
128ms Preflight
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 931f61affc4269c8-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 17 Apr 2025 22:33:00 GMT
server: cloudflare
vary: Origin

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 2C39
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?us_privacy=pbs-ozone&gdpr=0&gdpr_consent=&s=189937&cb=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D0%26gdpr_consent%3D%26us_pr...
https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAGBm9HM4WcAHw9OAM0IIgAA%262421

0
780 B

102ms
98ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAGBm9HM4WcAHw9OAM0IIgAA%262421
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931f61b06dc8cbae-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0qZMXPmP8JRPN%2FXs9uDEq5KfLfe%2Fmm7DOf6HFWt%2F3kmeNto6%2BE2m6E%2BsBek5QSFc30Opmbcot8qbOmil1fC4tYgxO3y9YSqj0xJmesb3NI8ePaJ2M7QDaJWv6nU0FGJqyloVV%2B5W"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAGBm9HM4WcAHw9OAM0IIgAA%262421
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931f61af8c3dcba7-LAX
content-length: 0
server: cloudflare

GET
DATA 200
OK truncated
/ Frame 2C87 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 2C87 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 2C39
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://elb.the-ozone-project.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=8603902614458982697

0
952 B

99ms
98ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=8603902614458982697
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931f61b22b99cbae-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://elb.the-ozone-project.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=8603902614458982697
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.247; 162.245.206.247; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 8ff5de21-9836-4c97-a450-1db9503f8467
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 22:33:00 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 8B02 0
412 B 392ms
125ms Document
text/html 3.209.238.154
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.238.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-238-154.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Thu, 17 Apr 2025 22:33:00 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 20B5 1 KB
1 KB 368ms
97ms Script
text/javascript 35.201.101.243
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?ctx=21072637&cmp=33202206&sid=7193375&plc=413987611&crt=229616210&advid=9943198&adsrv=1&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&unit=160x600&prr=1&turl=https://paint.toys/oil/&aucmp=22168922118&auevent=ABAjH0jwRa_c3IovsA5089WFkyts&autt=1&ppid=103&aucrtv=638678738&auorder=1020115579&pltfrm=8&ausite=1995081996404&auxch=8&aufilter1=641046&c1=641046&adid=&app=&dup=&gmnpo=&isdvvid=&supplySource=&tagtype=&aUrlD=0&brid=96&bridua=3&brver=&fcl=1298&fec=143&flt=0&brh=2&vavbkt=&lvvn=28&fcifrms=25&winh=1200&winw=1600&chro=1&noc=48&wouh=1200&wouw=1600&htmlmsging=1&refD=1&scah=1200&scaw=1600&jsver=7656&uid=1744929180382867&fwc=0&srcurlD=0&ttfrms=60&num=6&dvp_isOnHead=0&flvr=1&ver=7656&jsCallback=__verify_callback_1744929180382867&jsTagObjCallback=__tagObject_callback_1744929180382867&ssl=1&m1=96&blkmode=2&ee_dp_rdystreq=interactive&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=7777787784.004933&ee_dp_sukv=7777787784.004933&dvp_tukv=1847866912.3124611&ee_dp_tukv=1847866912.3124611&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTau%40%3A%3DTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JD&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.101.243 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 243.101.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 96c05de7de29d0a8934285b52abeca8887cf3724fa5cffb0c094c5b6c9441781

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 1
Expires: 04/16/2025 22:33:00
Date: Thu, 17 Apr 2025 22:33:00 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 2C39
Redirect Chain

https://ads.yieldmo.com/pbsync?is=ozone&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirectUri=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dyieldmo%26gdpr%3D0%26gdpr_consent%3D%26us_p...
https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcMAKZZCMAZYUHfhSx6Z&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone

0
956 B

95ms
95ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcMAKZZCMAZYUHfhSx6Z&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931f61b398eccbae-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

location: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcMAKZZCMAZYUHfhSx6Z&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame B9B6 7 B
1 KB 489ms
124ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame ACB5 7 B
1 KB 485ms
121ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 314e432eb2d967cf733b82bdbbe35231
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 1BCD 20 KB
7 KB 120ms
119ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=151497
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 17 Apr 2025 22:33:00 GMT
expires: Sat, 19 Apr 2025 16:37:57 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
DATA 200
OK truncated Show response
/ Frame FDDD 911 B
911 B Document
text/html

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e8e594776e39f8be15b6dffece84d77457b27ad2943e51e723d06361c6baff3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Content-Type: text/html

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 20B5 0
482 B 426ms
136ms Ping
image/gif 64.233.180.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDWEOalT8yigNf-LjkQ7PdLhBRXDbqHcbgE-g6jrybM6kKgX65sTiyqcrVaEfs0556tarWWdL0ylvh59k9lTBaNSLHYTsu5xZiD0ip9ubwcnYjjKdWU5PyH7v6rM4PzSgC2cvDRhAkFJpjKyTz0D-Vs21u5EGk-3wlkFeWwXL7F1FNmwEhlcsi3782PLv1dCJ-4Ahs7ynGhpesJ0gIwThMq_dHh20&sai=AMfl-YRkhXZDqvEjEocGYV1lpCHCfBYDTcZ-Bxx2L7HnsilE07fYrtPTUswLLJ1doFBuLY8IGJZjcCadP5nnAWWVJiGY-yQlz7HY031pTX0eAPHQ8jULAk9OOSgFMmgb8w69hbrCW04rh2WngCnZITRYQtCwIz3DSZIKukaWXYGUBBjTFT42u1JHPAlW82_bySnbTEnXwEPgbSZK-YAleZ_GIn8slJPSaFDW6A_JueCm3GxZl98cNEJmmqJ0nvIaG1yeHq0ap8pMW6gY9zB_JOQfMz1_XvkES00JNQLj3wOObwf-dCeLpBR8LPVjNMronbK982wOothchsS23l-Tux0FIPpE-oHIT7awYTgnj--FrKsn-Q2A9htWeFuQZdwhkeV-okN9mU8zG3YjrYiHLeMGVgiWLjR129j53allIMRBAVdw&sig=Cg0ArKJSzItorDtvesNwEAE&uach_m=%5BUACH%5D&urlfix=1&vt=13&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 17 Apr 2025 22:33:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame FDDD 2 KB
1 KB 369ms
121ms Script
text/javascript 2600:1408:5400:23::b819:7f4b
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=2303585&cmp=20250310&plc=31025002&sid=29259&dvregion=0&unit=160x600
Requested by: Host: text
URL: data:text/html,%0A%20%20%20%20%20%20%3Chtml%20style%3D%22margin%3A0%3B%20padding%3A0%3B%20overflow%3Ahidden%3B%22%3E%0A%20%20%20%20%20%20%20%20%3Chead%3E%3C%2Fhead%3E%0A%20%20%20%20%20%20%20%20%3Cbody%20style%3D%22margin%3A0%3B%20padding%3A0%3B%20overflow%3Ahidden%3B%22%3E%0A%20%20%20%20%20%20%20%20%20%20%3Cscript%20type%3D%22text%2Fadtag%22%3E%0A%3Cins%20class%3D'dcmads'%20style%3D'display%3Ainline-block%3Bwidth%3A160px%3Bheight%3A600px'%0A%20%20%20%20data-dcm-placement%3D'N1395.150740DOUBLEVERIFY%2FB9689862.280626343'%0A%20%20%20%20data-dcm-rendering-mode%3D'iframe'%0A%20%20%20%20data-dcm-https-only%0A%20%20%20%20data-dcm-gdpr-applies%3D'gdpr%3D%24%7BGDPR%7D'%0A%20%20%20%20data-dcm-gdpr-consent%3D'gdpr_consent%3D%24%7BGDPR_CONSENT_755%7D'%0A%20%20%20%20data-dcm-addtl-consent%3D'addtl_consent%3D%24%7BADDTL_CONSENT%7D'%0A%20%20%20%20data-dcm-resettable-device-id%3D''%0A%20%20%20%20data-dcm-app-id%3D''%3E%0A%20%20%3Cscript%20src%3D'https%3A%2F%2Fwww.googletagservices.com%2Fdcm%2Fdcmads.js'%3E%3C%2Fscr%2Bipt%3E%0A%3C%2Fins%3E%0A%3C%2Fscript%3E%0A%3Cscript%20language%3D%22javascript%22%20type%3D%22text%2Fjavascript%22%20src%3D%22https%3A%2F%2Fcdn.doubleverify.com%2Fdvbs_src.js%3Fctx%3D2303585%26cmp%3D20250310%26plc%3D31025002%26sid%3D29259%26dvregion%3D0%26unit%3D160x600%22%3E%0A%3C%2Fscript%3E%0A%20%20%20%20%20%20%20%20%3C%2Fbody%3E%0A%20%20%20%20%20%20%3C%2Fhtml%3E
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:5400:23::b819:7f4b Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 1949a9220e11f07e7e5c6088eb2b3985a73964d579f926cda707f83af11fc0bf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=86400
Content-Encoding: br
ETag: "d0889daac50bf65cd2b9e8012b60165a"
Connection: keep-alive
Expires: Fri, 18 Apr 2025 22:33:01 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 745
Date: Thu, 17 Apr 2025 22:33:01 GMT
Last-Modified: Wed, 05 Mar 2025 09:46:27 GMT
Content-Type: text/javascript

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 2C39
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redir=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpb...
https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT

0
1 KB

95ms
95ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931f61b4fe2ecbae-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT
date: Thu, 17 Apr 2025 22:33:00 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 20B5 42 B
65 B 133ms
133ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsus5bq7nugpX7t67CQEjUQflGG_B9fBp6IblTLmreQSYxnm-VWtQ1pwm_3beXqKD4RBLq1yDHtZtPTH_2h5hkb2UO5NAqitG1adH7Z3SQTlQiUL89u5GCSDf66L8Rnx7qA9s6pY7Jn37DgDfervkS7F&sig=Cg0ArKJSzOAIDP8Zz3J-EAE&id=lidar2&mcvt=1006&p=0,0,604,160&tm=1024.5&tu=18.200000762939453&mtos=0,1006,1006,1006,1006&tos=0,1006,0,0,0&v=20250416&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=32&adk=0&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4086197900&rst=1744929179100&rpt=700&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 17 Apr 2025 22:33:00 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 20B5 42 B
65 B 133ms
133ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvNONLwDnItdDVPXpTNtRc7aJHHecT-yOogIsAshYwa0a2yIYOu27VeV3b9I9DTSFpgyXnddYPkWdonNGLQruNtc7v4RMHGnIEP6JUVJFI_o9Rs456vDYnrrMJKvKL8AY1EhpqM5G-RsYXECVum3HjmCOkbZM6zDAKwZmxnuBmi43IG&sig=Cg0ArKJSzLticpXToVPOEAE&id=lidar2&mcvt=1010&p=313,20,917,180&tm=1033.3999996185303&tu=23.5&mtos=0,1010,1010,1010,1010&tos=0,1010,0,0,0&v=20250416&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=19&adk=2747221344&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4086197900&rst=1744929179100&rpt=693&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 17 Apr 2025 22:33:00 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame EFDE 0
100 B 391ms
123ms Document
text/plain 3.212.245.4
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.245.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-245-4.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Thu, 17 Apr 2025 22:33:01 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 2C39
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-ozone&gdpr=0&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9LXS2TY-4-BMYX&gdpr=0

0
1 KB

92ms
91ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9LXS2TY-4-BMYX&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931f61b65afecbae-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 22:33:01 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9LXS2TY-4-BMYX&gdpr=0
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e71ccbe96f42d70fa40603ada4c96b28
content-length: 0
Content-Type: text/html

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 135ms
133ms Fetch
text/plain 2607:f8b0:4004:c1f::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54g3v9101576445za200&_p=1744929175109&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130495~103130497&cid=1361009009.1744929176&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAI&_s=2&sid=1744929176&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=7&tfd=6779
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1f::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:33:01 GMT
content-type: text/plain
server: Golfe2

GET
H/1.1 200
OK dvbs_src_internal137.js Show response
cdn.doubleverify.com/ Frame FDDD 62 KB
18 KB 131ms
130ms Script
text/javascript 2600:1408:5400:23::b819:7f4b
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal137.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=2303585&cmp=20250310&plc=31025002&sid=29259&dvregion=0&unit=160x600
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:5400:23::b819:7f4b Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 7f20216b5cf51fcfb0860e1f04654351fc1590d87dfc7705341851e8d2d11bc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=31536000
Content-Encoding: br
ETag: "874fb1ea87f9b0efe2858df88e8f4504"
Connection: keep-alive
Expires: Fri, 17 Apr 2026 22:33:01 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 18527
Date: Thu, 17 Apr 2025 22:33:01 GMT
Last-Modified: Wed, 05 Mar 2025 09:46:29 GMT
Content-Type: text/javascript

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame ACB5
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=vidazoo&khaos=M9LXS2TY-4-BMYX
https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=M9LXS2TY-4-BMYX

43 B
496 B

131ms
130ms

Image
image/avif

198.199.88.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=M9LXS2TY-4-BMYX
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 198.199.88.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 17 Apr 2025 22:33:01 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=M9LXS2TY-4-BMYX
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 68924088df51cc4f44725d2003b1af80
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 2C39
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=4500028475502074209

0
1 KB

103ms
103ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=4500028475502074209
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 931f61bb4c1ecbae-LAX
expires: 0
content-length: 0
date: Thu, 17 Apr 2025 22:33:02 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=4500028475502074209
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 17 Apr 2025 22:33:01 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H3 200 cm Show response
u.openx.net/w/1.0/ Frame 562D 953 B
973 B 90ms
89ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d45b425a28292f590b221fa65a52e73c8d0351944227721706fde1865386d08f

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 953
content-type: text/html
date: Thu, 17 Apr 2025 22:33:01 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.247

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame FDDD 678 B
732 B 223ms
96ms Script
text/javascript 35.201.101.243
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_68778812389&jsTagObjCallback=__tagObject_callback_68778812389&num=6&ctx=2303585&cmp=20250310&plc=31025002&sid=29259&advid=&adsrv=&unit=160x600&isdvvid=&uid=68778812389&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&ee_dp_rdystreq=loading&dvp_intrst=1&dvp_ttp=&nav_pltfrm=Linux%20x86_64&brid=1&brver=&bridua=3&dup=null&srcurlD=2&ssl=1&refD=2&htmlmsging=1&tstype=128&m1=15&noc=48&fcifrms=28&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=183&eparams=DC4FC%3Dl52E2TbpE6IETau9E%3E%3DTarTad_pTada_Tada_Tada_Tada_Tada_Tada_Tadbr9E%3E%3DTada_DEJ%3D6TadbsTadaa%3E2C8%3A%3FTadbp_TadbqTada_A255%3A%3F8Tadbp_TadbqTada_%40G6C7%3D%40HTadbp9%3A556%3FTadbqTadaaTadbtTad_pTada_Tada_Tada_Tada_Tada_Tada_Tada_Tada_Tadbr9625TadbtTadbrTadau9625TadbtTad_pTada_Tada_Tada_Tada_Tada_Tada_Tada_Tada_Tadbr3%405JTada_DEJ%3D6TadbsTadaa%3E2C8%3A%3FTadbp_TadbqTada_A255%3A%3F8Tadbp_TadbqTada_%40G6C7%3D%40HTadbp9%3A556%3FTadbqTadaaTadbtTad_pTada_Tada_Tada_Tada_Tada_Tada_Tada_Tada_Tada_Tada_TadbrD4C%3AAETada_EJA6TadbsTadaaE6IETadau25E28TadaaTadbtTad_pTadbr%3A%3FDTada_4%3D2DDTadbsV54%3E25DVTada_DEJ%3D6TadbsV5%3ADA%3D2JTadbp%3A%3F%3D%3A%3F6%5C3%3D%404%3CTadbqH%3A5E9Tadbp%60e_AITadbq96%3A89ETadbpe__AIVTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5CA%3D246%3E6%3FETadbsV%7D%60bhd%5D%60d_fc_s~%26q%7Bt%27t%23xu*Tadauqheghgea%5Dag_eaebcbVTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5CC6%3F56C%3A%3F8%5C%3E%4056TadbsV%3A7C2%3E6VTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5C9EEAD%5C%40%3F%3DJTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5C85AC%5C2AA%3D%3A6DTadbsV85ACTadbsTadacTadfqvs!%23TadfsVTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5C85AC%5C4%40%3FD6%3FETadbsV85AC04%40%3FD6%3FETadbsTadacTadfqvs!%230r~%7D%24t%7D%250fddTadfsVTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5C255E%3D%5C4%40%3FD6%3FETadbsV255E%3D04%40%3FD6%3FETadbsTadacTadfqpss%25%7B0r~%7D%24t%7D%25TadfsVTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5CC6D6EE23%3D6%5C56G%3A46%5C%3A5TadbsVVTad_pTada_Tada_Tada_Tada_52E2%5C54%3E%5C2AA%5C%3A5TadbsVVTadbtTad_pTada_Tada_TadbrD4C%3AAETada_DC4TadbsV9EEADTadbpTadauTadauHHH%5D8%40%408%3D6E28D6CG%3A46D%5D4%40%3ETadau54%3ETadau54%3E25D%5D%3BDVTadbtTadbrTadauD4CTadaq%3AAETadbtTad_pTadbrTadau%3A%3FDTadbtTad_pTadbrTadauD4C%3AAETadbtTad_pTadbrD4C%3AAETada_%3D2%3F8F286TadbsTadaa%3B2G2D4C%3AAETadaaTada_EJA6TadbsTadaaE6IETadau%3B2G2D4C%3AAETadaaTada_DC4TadbsTadaa9EEADTadbpTadauTadau45%3F%5D5%40F3%3D6G6C%3A7J%5D4%40%3ETadau5G3D0DC4%5D%3BDTadbu4EITadbsab_bdgdTadae4%3EATadbsa_ad_b%60_TadaeA%3D4Tadbsb%60_ad__aTadaeD%3A5TadbsahadhTadae5GC68%3A%40%3FTadbs_TadaeF%3F%3AETadbs%60e_Ie__TadaaTadbtTad_pTadbrTadauD4C%3AAETadbtTad_pTada_Tada_Tada_Tada_Tada_Tada_Tada_Tada_TadbrTadau3%405JTadbtTad_pTada_Tada_Tada_Tada_Tada_Tada_TadbrTadau9E%3E%3DTadbtU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar52E2TbpTauTau&dvp_exetime=12.00&callbackName=__verify_callback_68778812389
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal137.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.101.243 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 243.101.201.35.bc.googleusercontent.com
Software: /
Resource Hash: b1547d7fab1a26e4d6b1d30b7c5732f31e11418c7abb8515ef843d3ed8b2bde9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 1
Expires: 04/16/2025 22:33:01
Date: Thu, 17 Apr 2025 22:33:01 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B9B6
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

382ms
124ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f3c5bf77-5e8e-4c3e-8d8f-869669990efc&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 17 Apr 2025 22:33:01 GMT
server: Kestrel

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B9B6
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/Qs-7ZwETJ4U4c9CtFvCZJA?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-NXpirkJE2oKNXSRdYmqKOngva876i4fEmqK25w--~A

42 B
1 KB

244ms
120ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-NXpirkJE2oKNXSRdYmqKOngva876i4fEmqK25w--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-NXpirkJE2oKNXSRdYmqKOngva876i4fEmqK25w--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 17 Apr 2025 22:33:01 GMT
server: ATS
x-frame-options: DENY

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B9B6
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlMWFMyVFktNC1CTVlY&us_privacy=1NNY

170 B
188 B

135ms
134ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlMWFMyVFktNC1CTVlY&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:33:01 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlMWFMyVFktNC1CTVlY&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f69a50991384d09413b97a37bb74928b
Pragma: no-cache
content-length: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame B9B6
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9LXS2TY-4-BMYX&us_privacy=1NNY

0
144 B

142ms
139ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9LXS2TY-4-BMYX&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D2E9E3DA3C66469BAF57FA9FBDE16EC9 Ref B: LAX311000115035 Ref C: 2025-04-17T22:33:01Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzAPwHb2gFB816TDpg0w==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 17 Apr 2025 22:33:00 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9LXS2TY-4-BMYX&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 8bab65602db075726861004da5629947
Pragma: no-cache
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B9B6
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDk0Yzg5MWExMDI1MGVmYzgwMmM0YWVhMjYyNGI2M2NiZmM2MDM4OA&us_privacy=1NNY

170 B
188 B

134ms
133ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDk0Yzg5MWExMDI1MGVmYzgwMmM0YWVhMjYyNGI2M2NiZmM2MDM4OA&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:33:01 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDk0Yzg5MWExMDI1MGVmYzgwMmM0YWVhMjYyNGI2M2NiZmM2MDM4OA&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
Pragma: no-cache
content-length: 0

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame B9B6 170 B
188 B 142ms
135ms Image
image/png 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 22:33:01 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B9B6
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=M9LXS2TY-4-BMYX&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

132ms
131ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=M9LXS2TY-4-BMYX&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: A1V7YPCB9P0XEJ5Y9B1K
Content-Length: 43
Date: Thu, 17 Apr 2025 22:33:01 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=M9LXS2TY-4-BMYX&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 20e8391fc78a9019eb67dba4b22f0ac2
content-length: 0
Content-Type: text/html

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame B9B6 43 B
855 B 722ms
283ms Image
image/gif 52.94.223.37
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: JA258A0E0FS8FWKJDJ31
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 17 Apr 2025 22:33:01 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame B9B6 43 B
855 B 136ms
131ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS