paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.buymojatom.com/b8yljqb74n4pxypvd3xy66rmiRV2JVT3FKZzQ2S3NaT1U3SGY3VTItMjYyNi0yNjc4NjAyNi0wZmZlMDI3Ni0zNjkwLW91b2dNNDhlRVJtM0FubVliUXdZ/wflymo4mxb977dpo0c8x95gaevnzoosgu/wnpcgn
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 79737
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Fri, 18 Apr 2025 05:42:12 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JS3PPFFT6PT3R9J21BVPNRVJ

Redirect headers

accept-ranges: bytes
age: 79737
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1666
content-type: text/html; charset=UTF-8
date: Fri, 18 Apr 2025 05:42:12 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JS3PPFDDPCRCMHR0YG5PNC3K

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 315ms
213ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b6fc348f8786bf50cf4dcfbd64e0fbdfff270f7c9ee008207dd2d5837353462

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
content-encoding: br
cf-ray: 9321d66a9ed9d9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 74ms
74ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 379205
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JS3PPFJEBSSTNV5Z1Y7TN65S
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 05:42:12 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 110ms
110ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 11301
accept-ranges: bytes
content-length: 1205
x-nf-request-id: 01JS3PPFJEG4604FDXD4PG6FC6
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 05:42:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 73ms
73ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 9613
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JS3PPFJE2VWM7Q7A4MHR93SD
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 05:42:12 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 109ms
109ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 9613
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JS3PPFJE1CYPA66V8V0C4S5S
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 05:42:12 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 74ms
73ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 379205
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JS3PPFP15JPRB2WMBRWX50VC
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 05:42:12 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 75ms
74ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 365886
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JS3PPFPAKDYDJRXQJZ7GS6CQ
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 05:42:12 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 53ms
52ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 549eb2b00b77447e173d598971ead70522e08471623056ec99236f74b3b927a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9321d66acf39d9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:12 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
123 KB 688ms
280ms Script
application/javascript 2404:6800:4006:80a::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:80a::2008 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3366141bd0ce29163bba97c6cda420815407a93b106a586bb63ee7eb3c11c273

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Fri, 18 Apr 2025 05:42:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 125602
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 41dc2f87ded629d7d50d348fec190978d7d6754a055119da.v2.js Show response
faucetfoot.com/public/js/ 68 KB
25 KB 821ms
299ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/public/js/41dc2f87ded629d7d50d348fec190978d7d6754a055119da.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

951e2a794dd590046363477ae71f93f2ce5c573bdb8fdcdb63210ff295475d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"bddf37df2200f40e06481778bbc964d617e9a3b3ed55ea65ef3da6e7ec1f527a"
via: fen-hoothoot-asia-east1-k74r.gce-asia-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
33 KB 385ms
203ms Script
text/javascript 172.217.24.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.24.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38ef5aa6bdb6677b3cc41ef31ea66d451f585c917f705df767e617bd0659069c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 435 / 20196 / m202504150101 / config-hash: 9604267607936975774
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 05:42:13 GMT
alt-svc: h3=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34040
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 58ms
56ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 2998
cf-ray: 9321d66c0a09d9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 411 B
363 B 49ms
48ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b35367386570f17ff5be2b4d3f5a9ef2816b7947869005cfae73ec88dcba460

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"038af8099c70ce8099f11e60671651ea"
age: 3002
cf-ray: 9321d66c0a0bd9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.f78d8905f1617efa83f4.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 42ms
42ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aed279b0a29e774ca22dafc6a078e7582490608c9d18bda1a138ca55d0d5be9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"f1a6e4325cdcf59d711cbdc9bbf9de8f"
age: 3002
cf-ray: 9321d66c5aa3d9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.f49d9d120d738f961843.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 461 KB
140 KB 77ms
77ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad7d0d55c693f50a025e443da2f37eaea32dad37cbfe918cde1717f8f33af733

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"2da544a46407e9f6f4d2fc5d5058f814"
age: 3002
cf-ray: 9321d66c5aa4d9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 559 B
444 B 45ms
45ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 2990
cf-ray: 9321d66dde0dd9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame B9FC 503 B
427 B 156ms
42ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 3002
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9321d66ebe96d9a2-AKL
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 05:42:13 GMT
hw-country-code: NZ
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame BE31 503 B
0 153ms
153ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 3002
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9321d66ebe96d9a2-AKL
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 05:42:13 GMT
hw-country-code: NZ
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 TIER_1 Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/1/desktop/Chrome/ 584 B
919 B 252ms
65ms XHR
application/json 2600:9000:2212:be00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/1/desktop/Chrome/TIER_1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2212:be00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c6b85ac1d4af79ea67ea394896c1373ca5d6b9875274cbdf4133e2def90ddaeb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 720
via: 1.1 8bec138951dfffa4e8e0ac983bb30e76.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 584
x-amz-cf-id: cdmEQExjYAHMpY7d93_xrg54oJdCXg2OaPBtQ9406ZQC0_kqU9CIBg==
date: Fri, 18 Apr 2025 05:30:13 GMT
content-type: application/json
x-amz-cf-pop: SYD62-P1
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 149 KB
39 KB 128ms
46ms Script
application/javascript 2606:4700:10::6816:4bd8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4bd8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db3b4c65b9b7c658c43074b51473188ca8efe46a669c6801234e3267be15168a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "c270076359905b3d723a15d71336e6a6"
via: 1.1 google
cf-ray: 9321d66e9f39d993-AKL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39507
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: application/javascript
last-modified: Fri, 18 Apr 2025 05:07:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 357 KB
86 KB 235ms
78ms Script
application/javascript 108.158.28.226
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.28.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-28-226.syd3.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8d079b3855248fcdd0eb891569d2c669c4df9d09e81270f254e37280b51e274a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"8eb33601d7a1e0448ae3ae6845bc11ff"
age: 2082
via: 1.1 e8e5556eec12cd8fd3590100b82fb80a.cloudfront.net (CloudFront), 1.1 1756a318e802526c12a1158627f4728e.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 9BHmgrDbPZEzvW3pC6MF1lYUM9FXV9Nrok7s94kiStiFPTqbw_b4Jw==
date: Fri, 18 Apr 2025 05:07:32 GMT
content-type: application/javascript
last-modified: Tue, 15 Apr 2025 20:04:14 GMT
server: AmazonS3
x-amz-cf-pop: SYD1-C1, SYD3-P2
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
584 B 117ms
37ms Image
image/gif 2606:50c0:8000::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8000::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: c6019f3ca36e2b421b588fafae0c99ebbcf9a34c
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 1DDA:A4017:40489:B43B5:67EBFE6A
expires: Fri, 18 Apr 2025 05:47:13 GMT
x-cache: HIT
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: image/gif
x-served-by: cache-akl10325-AKL
x-cache-hits: 13
source-age: 107
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1744954934.533987,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 257ms
79ms Script
text/javascript 108.158.20.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.20.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-20-59.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 68867
via: 1.1 aeb2692086ca3fc7d14822f811ae17a0.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: UAoml3-APg0XN-sa21IxQzu0MoOgULaRnIxcm3JYdQbk1G98yl4NeQ==
date: Thu, 17 Apr 2025 10:34:26 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P3
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/ 529 KB
167 KB 85ms
85ms Script
text/javascript 172.217.24.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.24.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31e988de147264b3ff0990eac51ed08398a7346729cbd42b231876431fbb4020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 3850784624983485084
age: 47770
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 16:26:03 GMT
alt-svc: h3=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 16:26:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170612
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/ 64 KB
23 KB 177ms
176ms Other
text/plain 172.217.24.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.24.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4a1f6bb4df43a4e3aded46465e55b8749b64817d13ed9557075c596d218c340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5790688912801242087
age: 56454
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 14:01:19 GMT
alt-svc: h3=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 14:01:19 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23384
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504170101"

GET
H2 200 init-a.js
dl.edge-aicdn.net/assets/ 0
0 130ms
48ms Fetch
text/javascript 2606:4700:20::681a:bb8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://dl.edge-aicdn.net/assets/init-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bb8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 35313
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cfY6JNdsmFBW7q4EgBH9WEOBovJM7VHBZJx3KCkrwBg77Ce8wypslbhGNnFF5oBbevppacIh6LcxXObk5CTtbeke3DDPB4HFre7Qo8NOQJ9YNCAEx8DTQEeewqQ53i698t5wAO6DttjbfCtRf7vz"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Thu, 17 Apr 2025 20:16:34 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=34615&min_rtt=34430&rtt_var=7542&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3818&recv_bytes=2172&delivery_rate=115526&cwnd=252&unsent_bytes=0&cid=a8d784d06c1e8dab&ts=55&x=0"
x-goog-stored-content-length: 0
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:38:53 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2VwoV1sFrFgB2KzgZYJqAyn4SwLxqwDn1lj3IVg68nCNJ4JBEJ4k4IxzRoKy6aCqGmXJE
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 9321d66f7dd77257-AKL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743183533533707
content-length: 0
server: cloudflare

GET
H2 200 config-a.js
storage.ml-cachehost.net/lib/ 0
0 129ms
45ms Fetch
text/javascript 2606:4700:20::ac43:4488
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://storage.ml-cachehost.net/lib/config-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4488 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 35313
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CRut8LXQfQEDJA7ZIUeRFFwUWlHExtbkk19BBtHKlW%2BK%2BwliR%2F55ar7hjZ6EDopw98FbJRWRCyA4CM%2BEFaJiDStfQBzPdsx4DoKeEDe26%2FGNqAVwc4Hz05gPTfZP4hlAYXKqRQozFf3enapQRim5WG1Dczt%2BPw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Thu, 17 Apr 2025 20:15:36 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=34796&min_rtt=34447&rtt_var=7798&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3830&recv_bytes=2216&delivery_rate=113777&cwnd=253&unsent_bytes=0&cid=83d706750b3bbc9f&ts=52&x=0"
x-goog-stored-content-length: 0
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:51:11 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2VwoFKzMhPIchikRyh1_kqJvEGSPsuCgM8NTgA5MCQngOooZ94_6K9mt_3h6DzL0Gubo
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 9321d66f7fe9d994-AKL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743184271495855
content-length: 0
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
620 B 134ms
46ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 39019
x-goog-stored-content-encoding: identity
expires: Thu, 17 Apr 2025 19:12:20 GMT
x-goog-stored-content-length: 43
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwp6bloQWyUJsteF1G1-bcKyWaTEtp-1so50KioLwnjAU9UmMCBP9vUtIAxWOLYu-Sm0
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9321d66f8ac2d9b0-AKL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 280ms
90ms Image
image/x-icon 142.250.204.6
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s25-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 25826
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 22:31:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 22:31:47 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 136ms
48ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9595069801295444
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 39019
x-goog-stored-content-encoding: identity
expires: Thu, 17 Apr 2025 19:12:20 GMT
x-goog-stored-content-length: 43
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwp6bloQWyUJsteF1G1-bcKyWaTEtp-1so50KioLwnjAU9UmMCBP9vUtIAxWOLYu-Sm0
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9321d66f8ac7d9b0-AKL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame B9FC 17 KB
7 KB 50ms
48ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3000
cf-ray: 9321d66f0f5fd9a2-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame BE31 17 KB
0 49ms
49ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3000
cf-ray: 9321d66f0f5fd9a2-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET f89b393c-3a7f-4caa-af01-2ce488bed40d
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 760ms
261ms Preflight
application/json 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 18 Apr 2025 05:42:13 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 199374
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 98ms
46ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 35313
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744849264&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=X3gSeLRfUJtM22yoDZ4OUn6oUCLutpq5htWBIZaR7uk%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Thu, 17 Apr 2025 00:21:05 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744849264&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=X3gSeLRfUJtM22yoDZ4OUn6oUCLutpq5htWBIZaR7uk%3D
hw-country-code: NZ
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 9321d66fbe88d9b6-AKL
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
1 KB 51ms
47ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: NZ
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 3000
cf-ray: 9321d66f7974d9ba-AKL
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:08 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 769ms
251ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.buymojatom.com
URL: https://qwxz.buymojatom.com/b8yljqb74n4pxypvd3xy66rmiRV2JVT3FKZzQ2S3NaT1U3SGY3VTItMjYyNi0yNjc4NjAyNi0wZmZlMDI3Ni0zNjkwLW91b2dNNDhlRVJtM0FubVliUXdZ/wflymo4mxb977dpo0c8x95gaevnzoosgu/wnpcgn
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: a5026dc4ef271111eed7de2f75350b634f620676e646cbf82883e66e978f7fec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 446 KB
141 KB 720ms
301ms Script
text/javascript 2404:6800:4006:804::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:804::200a Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4511b4c0f49c9d4cbb075592d56afba3a187f735c6a940b1fe79b2c47693fc7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 17431135458542209878
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 05:42:14 GMT
alt-svc: h3=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144243
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 1031ms
341ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-22-201-236.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
852 B 775ms
282ms Fetch
application/json 54.151.178.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.151.178.61 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-151-178-61.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 1bb340eb5b45c698c11503b1b83b97166812615aaccc1022d01b5999199d2d13

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
685 B 784ms
250ms Fetch
application/javascript 52.3.206.124
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.206.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-206-124.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 126b8161f98aa214c0dd73fbde0d362f9cfd8cf7597922b22f9c2b48169ff957

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
246 B 413ms
234ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
366 B 1049ms
257ms Fetch 52.22.201.236
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js3ppgdyqmnsz9hcga8dr3cx&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.201.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3599, private
trace-id: 11212a231804ceaa
request-time: 6
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 06:42:14 GMT
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:14 GMT
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=--0rx3xmeFFaQmxid3h1bEJxckdFYmhxMWEvUmFUTDRSU3ZMNlZGZkpJR2piTTdIZHJFNUlTR3AySmJMWnQ0VE1sZGtyaXlvUkpmZXd4Y3M4Yk8zMFdKU2FvUUVpR3hxbDdQNG9JRUdBdVAvTkhXU1FhUFhLUjRkVWNZcl...

359 B
925 B

1213ms
157ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=--0rx3xmeFFaQmxid3h1bEJxckdFYmhxMWEvUmFUTDRSU3ZMNlZGZkpJR2piTTdIZHJFNUlTR3AySmJMWnQ0VE1sZGtyaXlvUkpmZXd4Y3M4Yk8zMFdKU2FvUUVpR3hxbDdQNG9JRUdBdVAvTkhXU1FhUFhLUjRkVWNZclkwK0c5VWtnNXF1a1phRDI4Q2xwZ2IzVkNHaTQ3U3hVck1TQkJOYmNhWFUwS2ZFOUZCempOelhHRk85Qk91L0c1OVJIVzAvM2JBMU1neWh4dUxhYzQxU29JZzY3cGZnWHhoUDVaK0RObTJTUjFKR3lFcHllaVJuVnFEbDRYenVUMkZQa1J5SEtifA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

8b06618986baabc8910a31b1768b082c050be0306acc7c009fc9f49b8f47ca30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 697769
expires: 0
access-control-allow-origin: null
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=--0rx3xmeFFaQmxid3h1bEJxckdFYmhxMWEvUmFUTDRSU3ZMNlZGZkpJR2piTTdIZHJFNUlTR3AySmJMWnQ0VE1sZGtyaXlvUkpmZXd4Y3M4Yk8zMFdKU2FvUUVpR3hxbDdQNG9JRUdBdVAvTkhXU1FhUFhLUjRkVWNZclkwK0c5VWtnNXF1a1phRDI4Q2xwZ2IzVkNHaTQ3U3hVck1TQkJOYmNhWFUwS2ZFOUZCempOelhHRk85Qk91L0c1OVJIVzAvM2JBMU1neWh4dUxhYzQxU29JZzY3cGZnWHhoUDVaK0RObTJTUjFKR3lFcHllaVJuVnFEbDRYenVUMkZQa1J5SEtifA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 208090
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Fri, 18 Apr 2025 05:42:14 GMT
server: Kestrel

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_cc42fb00-eda2-4bb0-b12a-a157c8406620_1744954933644
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_cc42fb00-eda2-4bb0-b12a-a157c8406620_1744954933644

1 KB
1 KB

77ms
76ms

Script
application/javascript

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_cc42fb00-eda2-4bb0-b12a-a157c8406620_1744954933644
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: d75dd4601fa63d211857ae5dbfdf2878ea5c74a2496ec7c5153c8a100d80a100

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1130
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 05:42:14 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_cc42fb00-eda2-4bb0-b12a-a157c8406620_1744954933644
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 05:42:14 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 749ms
255ms XHR
application/json 18.142.20.179
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.142.20.179 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-142-20-179.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 9401e0fd3ad284bfbe91942e265311ac71be318de215745f7efaaa20f027eab4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=utf-8

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 215ms
71ms XHR
application/javascript 108.158.28.226
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.28.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-28-226.syd3.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 16415
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: ll01mAzoSCu8_RM6_opcsUgYsWkPEj4cxeEGN7CKbUx2yswjvAK3UQ==
date: Fri, 18 Apr 2025 01:08:39 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 00625c2aa02f6876cd9570486ac98924.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: SYD3-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 230ms
69ms Script
application/javascript 108.158.32.72
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.32.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-32-72.syd3.r.cloudfront.net
Software: CloudFront /
Resource Hash: e127145c8c048e074ce1e24ed1b824a14390f3dc71d0a742197eb9690b7f7b20

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 3059
via: 1.1 b862c6b18a44c823dd40d8d760097ee2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: SStczoBwjxXQvSkHha595i0j9YqwvY7HNBOwR44VZVQC57JnaqoOOw==
date: Fri, 18 Apr 2025 04:51:14 GMT
content-type: application/javascript
x-amz-cf-pop: SYD3-P2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 569ms
565ms XHR
application/json 108.158.28.226
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.28.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-28-226.syd3.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
via: 1.1 1756a318e802526c12a1158627f4728e.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 3591
x-amz-cf-id: v_NgqtmgfqZ8eY79OpfPwJ969h2QUQU0bS62Es3HazN53JxQ07bTSA==
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: SYD3-P2
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 223 B
526 B 509ms
334ms Fetch
application/json 18.65.247.162
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.buymojatom.com%2F&pid=QJ99dKwI0aOtE&cb=0&ws=1600x1200&v=25.409.1848&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=d9c91e23-985f-469d-b63d-72921d2c3a68&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.247.162 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-247-162.syd3.r.cloudfront.net
Software: Server /
Resource Hash: 56c0b54842ceafe34ee696b38b47b38565ccc0a3191529c9e4ab573fa2bc9df6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 fbd92e37686376c632f471bbca198756.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 195
x-amz-cf-id: eT1tPAIYOZoOU7yV85fKGJwpmqr-NQGurkGkBTERPqwNfVRz8qgLTg==
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: SYD3-P1
server: Server

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame FD19 1 KB
2 KB 260ms
81ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1622
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 05:15:12 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AKDAyIsZfFr5MzAojt5S28sZbpzs1prWQXl7szT3h73A-sqmodQB55P1NJHKwAKd_TENckcSZj_zDmo

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame BAE0 2 KB
1 KB 234ms
72ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=167017
content-encoding: gzip
content-length: 859
content-type: text/html
date: Fri, 18 Apr 2025 05:42:14 GMT
expires: Sun, 20 Apr 2025 04:05:51 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 338ms
273ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d52d47f652f17f1e94f77ce28d8c26651179b7f6ff197f6e0247fec1e4fc84f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744954934&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=68yNlCApiG5X9NoJh%2BC72FlwfUsATcAcIe%2FRCqjFujs%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744954934&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=68yNlCApiG5X9NoJh%2BC72FlwfUsATcAcIe%2FRCqjFujs%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9321d6715f4bd99f-AKL
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 423 B
1 KB 485ms
425ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ee27c25f09b6a6aea098ce3d2bfe17d29d2a247811b51e60943f3f0910fe593

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744954934&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=68yNlCApiG5X9NoJh%2BC72FlwfUsATcAcIe%2FRCqjFujs%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744954934&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=68yNlCApiG5X9NoJh%2BC72FlwfUsATcAcIe%2FRCqjFujs%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9321d6715f55d99f-AKL
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 859 B
876 B 341ms
294ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6ee08db5ab7bd1c5fe4383b72142841475b8cd6f156b7ba4e1d239e7a05e8d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6hxadf0Z17lJvMvnUCQNWokmLUl%2BjOTNmyyfa1pfbrP8WXNLh4livUwRe0djkA6W8kj8XpE8sdIU0coJSeYsda5%2BADai9%2FXUCwtTAO%2FflBVym8jDxZaMsVcLHeqKz%2BYlTvZUKQ9e"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9321d6714b78d9be-AKL
access-control-allow-origin: https://paint.toys
content-length: 240
server: cloudflare

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 476 B
2 KB 512ms
209ms Fetch
application/json 103.43.89.4
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.89.4 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4a129a18138c7b531867da57d63c9bf59f4cde513959fd6f64cc9368d3eb33f1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 078f98ae-8930-4902-ae89-57721ad571e8
content-length: 476
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:14 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1044ms
538ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 05:42:14 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1023ms
517ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 05:42:14 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 955ms
450ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 05:42:14 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 959ms
453ms Fetch 167.99.22.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 167.99.22.191 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 05:42:14 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
454 B 1013ms
466ms Fetch 2406:2600:7:100::2c
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=9358968164&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::2c , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:14 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 846ms
339ms Fetch
application/json 54.151.166.244
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.151.166.244 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-151-166-244.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 743ms
250ms Fetch
application/json 52.77.143.1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744954933914&to=-720&aun=pw-160x600_atf&pubcid=2bdee551-cd0e-49f2-a410-355720fa4bde&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=6869de5e-4af1-4133-8395-2be3dda3a8e0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.143.1 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-143-1.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 743ms
250ms Fetch
application/json 52.77.143.1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744954933915&to=-720&aun=pw-160x600_btf&pubcid=2bdee551-cd0e-49f2-a410-355720fa4bde&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=f02563ce-cc9b-43a4-8896-43cbbc07cc05&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.143.1 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-143-1.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 740ms
246ms Fetch
application/json 52.77.143.1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744954933915&to=-720&aun=leaderboard_atf&pubcid=2bdee551-cd0e-49f2-a410-355720fa4bde&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=0f22adef-e3da-4489-b682-b7a0686542e3&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.143.1 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-143-1.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 742ms
249ms Fetch
application/json 52.77.143.1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744954933915&to=-720&aun=leaderboard_btf&pubcid=2bdee551-cd0e-49f2-a410-355720fa4bde&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=1d6d88e2-a6ef-4a46-b6d1-8c713b4e7f14&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.143.1 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-143-1.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
359 B 515ms
293ms Fetch
text/plain 35.186.253.211
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 1ddc059857b170481c962e10ad9e66da78441fb0b2ee142b550b1c8cf9a7ccec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 103.75.11.91
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: text/plain
vary: Origin

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 222 B
1 KB 836ms
752ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14b547bed3a98780832ed3eae58d44a32ff1770c8ddb4829ed3d17b7baa6715b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9321d671acf2d994-AKL
expires: 0
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 492 B
842 B 847ms
349ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.buymojatom.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=bf664718-561f-4eb7-af57-0df2523e8cb3&l_pb_bid_id=103d25d825493a318&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=6869de5e-4af1-4133-8395-2be3dda3a8e0&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.3744881292881591
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: da5a9f092c2dc9cd5e5f52eaba5d15453a234e0155c3a077113b6460ce82caa0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 492
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 492 B
1013 B 826ms
328ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.buymojatom.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=bf664718-561f-4eb7-af57-0df2523e8cb3&l_pb_bid_id=10489a2fbbdc3e128&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=f02563ce-cc9b-43a4-8896-43cbbc07cc05&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.3898992280748651
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: a1dadb75128a8fa3fbb8c78afd8c3e3f08432a5f4eb7a127813b216e4944def3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 492
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 497 B
847 B 841ms
343ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.buymojatom.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=bf664718-561f-4eb7-af57-0df2523e8cb3&l_pb_bid_id=105e4f8277e0ee69&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=0f22adef-e3da-4489-b682-b7a0686542e3&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.984764665408052
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: c8ea0bd6e11687c099e61078383162bbde4f5cfde9cf04b38a5cfdd014dbcf3a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 497
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 497 B
847 B 829ms
331ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.buymojatom.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=bf664718-561f-4eb7-af57-0df2523e8cb3&l_pb_bid_id=1062eef78876b25a&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=1d6d88e2-a6ef-4a46-b6d1-8c713b4e7f14&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.453189840448588
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: d4105db20a1f6e3c8ab2eb99dda4085b62f434c8b63a6951ad90e37628c351c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 497
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 487ms
164ms Fetch 67.199.150.87
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.87 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:14 GMT
server: nginx

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 640 B
753 B 838ms
320ms Fetch
application/json 54.255.192.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.255.192.26 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-255-192-26.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

e8082ff02caadae5699b0dbd2e2eadac9f298a7e765bc9cc6622394410569d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 397
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 671 B
739 B 900ms
383ms Fetch
application/json 54.255.192.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.255.192.26 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-255-192-26.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

8dc81a153c59f30cbb45d8e920410dac3a97dba728ef6a5cc62814a684e1c789

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 383
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 420 B
636 B 835ms
318ms Fetch
application/json 54.255.192.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.255.192.26 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-255-192-26.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

153b76d74512d5367d55e906b508d8c5cfc2e24267a7283f1ff03e598f36e269

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 279
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 547 B
672 B 839ms
323ms Fetch
application/json 54.255.192.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.255.192.26 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-255-192-26.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

a87de2c6e594da2fbf48feebc69d182dd60f639945cb64fd09539d0566868533

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 316
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 85 B
627 B 363ms
213ms Fetch
application/json 18.67.93.24
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-93-24.syd62.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 10ab968a04ac0261bd674b134772f3395e737db8f8daa6f49654ff50f80580cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 60a3c74b395afbd3a50d71e59ea19eca.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 110
x-amz-cf-id: iX5RGnEv-3BU1AnBPOMsh7LGUhQC-M_MOgFdGHGJl3WmWpB8Vt4GYA==
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json
x-amz-cf-pop: SYD62-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 41 KB
16 KB 1436ms
628ms Fetch
application/json 2406:2600:7:100::1b
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::1b , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4c0c595f95180126d31c74d41c6ede9702fc64e6dc5f0570dd9b24a9a6957330

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 201 KB
65 KB 738ms
321ms Script
application/javascript 2404:6800:4006:814::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:814::200e Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aa74b4106b72f256798236b295d6c4c86919206276ef9bc36edd3ebf1e5c0695

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kJj18iBGv13QYC3T5YOWFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmJw1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4uHYdqb9AJvAiZ4vPxmVNJLyC-OT8_NKijKTSkvyi9KS01KLU4vKUovijQyMTA1MDM30DAzjCwwAmV80Nw"
content-security-policy: script-src 'report-sample' 'nonce-kJj18iBGv13QYC3T5YOWFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 546ms
176ms XHR
application/octet-stream 35.162.56.239
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.162.56.239 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-162-56-239.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 314 KB
109 KB 267ms
266ms Script
application/javascript 2404:6800:4006:80a::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:80a::2008 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

46fcae091e847ee3e91ba019da0268525494eac2143491fd3db2fe4d411e2b64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Fri, 18 Apr 2025 05:42:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 111721
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 651ms
252ms Fetch
text/plain 2404:6800:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54g3v9101576445za200&_p=1744954932795&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=1494852250.1744954934&ul=en-nz&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744954934&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.buymojatom.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2432
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4006:809::200e Sydney, Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 535ms
174ms Image
image/gif 2600:9000:25f0:fc00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?service=ad&adid=ryghhm&adnum=965388
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f0:fc00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 130510
x-cache: Hit from cloudfront
x-amz-cf-id: BRqcj2H4t6u_PqjoMCuCLbSWPpiXaoAc-TWaufyK7Z3NdtWXG_qGKQ==
date: Wed, 16 Apr 2025 17:27:05 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 83a84568820d835ad60fa1c2aba27de2.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: SFO53-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1744954934204&did=did-0046&se=e30&duid=8e413bd09c43--01js3ppgdyqmnsz9hcga8dr3cx&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.buymo...
https://rp4.liadm.com/j?dtstmp=1744954934204&did=did-0046&se=e30&duid=8e413bd09c43--01js3ppgdyqmnsz9hcga8dr3cx&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.buym...

13 B
370 B

768ms
252ms

Fetch
application/json

3.217.98.102
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1744954934204&did=did-0046&se=e30&duid=8e413bd09c43--01js3ppgdyqmnsz9hcga8dr3cx&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.buymojatom.com%2F&cd=.paint.toys&i6=MjQwNDpmNzgwOjU6ZGVlOjpjMWU%3D&n3pc=true
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.217.98.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-217-98-102.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: b37a35ca-4f0b-4e7f-94c1-e9d759b84624
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1744954934204&did=did-0046&se=e30&duid=8e413bd09c43--01js3ppgdyqmnsz9hcga8dr3cx&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.buymojatom.com%2F&cd=.paint.toys&i6=MjQwNDpmNzgwOjU6ZGVlOjpjMWU%3D&n3pc=true
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Fri, 18 Apr 2025 05:42:14 GMT

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 2B2F 0
100 B 758ms
243ms Document
text/plain 18.142.149.22
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.142.149.22 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-142-149-22.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:14 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 9562
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t

382 B
1 KB

302ms
302ms

Document
text/html

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Server /

Resource Hash

b7e932c76f26fbd099483872de472e7674bb838e605d91d4d7cd709963235dd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 382
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 18 Apr 2025 05:42:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: ST4KRFW85V49SCEXNF6T

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: F1M6RSGN8W2YRKS6QF9Q

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=06841cff-44c8-430f-962a-95e1e48ff5fa&bid=1e2n4ou

70 B
440 B

72ms
72ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=06841cff-44c8-430f-962a-95e1e48ff5fa&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 05:42:14 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=06841cff-44c8-430f-962a-95e1e48ff5fa&bid=1e2n4ou
content-length: 191
date: Fri, 18 Apr 2025 05:42:14 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MkwtZmRPaXFGbDM2TVFoXzBoQ1BXXzJRQkduUV9rT09fQjhIMEdpaExHcjQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MkwtZmRPaXFGbDM2TVFoXzBoQ1BXXzJRQkduUV9rT09fQjhIMEdpaExHcjQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEG7B9Uxh38NUOjD8erf6470&google_cver=1

70 B
440 B

74ms
74ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEG7B9Uxh38NUOjD8erf6470&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 05:42:15 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEG7B9Uxh38NUOjD8erf6470&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Fri, 18 Apr 2025 05:42:15 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=6875541723614500951&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

92ms
73ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=6875541723614500951&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 05:42:14 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=6875541723614500951&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 2fce0467-cfe4-4e0b-a2a4-148867d2a9d3
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:14 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=eyeota
https://ps.eyeota.net/match?bid=tpm4omv&uid=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=

70 B
440 B

73ms
72ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=tpm4omv&uid=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 05:42:15 GMT
Content-Type: image/gif

Redirect headers

Location: https://ps.eyeota.net/match?bid=tpm4omv&uid=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=
Content-Length: 126
Date: Fri, 18 Apr 2025 05:42:15 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-zsB.g59E2pVkP2RcORoliNOA5y5la0dSi78-~A&gdpr=0

70 B
440 B

71ms
71ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-zsB.g59E2pVkP2RcORoliNOA5y5la0dSi78-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 05:42:15 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-zsB.g59E2pVkP2RcORoliNOA5y5la0dSi78-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/html
server: ATS

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 448ms
71ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qwxz.buymojatom.com
URL: https://qwxz.buymojatom.com/b8yljqb74n4pxypvd3xy66rmiRV2JVT3FKZzQ2S3NaT1U3SGY3VTItMjYyNi0yNjc4NjAyNi0wZmZlMDI3Ni0zNjkwLW91b2dNNDhlRVJtM0FubVliUXdZ/wflymo4mxb977dpo0c8x95gaevnzoosgu/wnpcgn
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Fri, 18 Apr 2025 05:57:14 GMT
accept-ranges: bytes
content-length: 17407
date: Fri, 18 Apr 2025 05:42:14 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 78ms
76ms Script
text/javascript 108.158.20.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qwxz.buymojatom.com
URL: https://qwxz.buymojatom.com/b8yljqb74n4pxypvd3xy66rmiRV2JVT3FKZzQ2S3NaT1U3SGY3VTItMjYyNi0yNjc4NjAyNi0wZmZlMDI3Ni0zNjkwLW91b2dNNDhlRVJtM0FubVliUXdZ/wflymo4mxb977dpo0c8x95gaevnzoosgu/wnpcgn
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.20.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-20-59.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 43056
via: 1.1 aeb2692086ca3fc7d14822f811ae17a0.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: WyGrxgu6aEDb8wFXLRo71E8VZMWEYiRBzrpyQvYPNBQb5q6jk9vCKQ==
date: Thu, 17 Apr 2025 17:44:39 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P3
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
340 B 200ms
52ms Script
application/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.buymojatom.com%2F&_it=amazon&partner_id=403
Requested by: Host: qwxz.buymojatom.com
URL: https://qwxz.buymojatom.com/b8yljqb74n4pxypvd3xy66rmiRV2JVT3FKZzQ2S3NaT1U3SGY3VTItMjYyNi0yNjc4NjAyNi0wZmZlMDI3Ni0zNjkwLW91b2dNNDhlRVJtM0FubVliUXdZ/wflymo4mxb977dpo0c8x95gaevnzoosgu/wnpcgn
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=432000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"ba4f7a703ea78ac1b72b5fe1be4fb407"
age: 3015
cf-ray: 9321d674d802d9bf-AKL
x-amz-request-id: 30EYP70N3Q8K0D6B
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/javascript
last-modified: Thu, 05 Dec 2024 20:48:49 GMT
server: cloudflare
x-amz-id-2: 5w5cbgPlgIr4aMvZIza9kfxWEorSRd5HlviyowD8OcJDSPOQIA2EkaPwRhS0y9EZjimo6XkJ9bI=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 225ms
49ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50e007518d200ae11214757387229dbd045c72df7a6180821e460442a605565a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: 4kzIBR7O0A8sc9O3C7UBqIVz1HHqBXZ7zJV0yyebInndK4OLrhf4oKlpXp1dxloFMOJUJhNAtauzO8pRsvprvQP39WZEu1jNyGBCToNebPw=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"5ad11df110aef21f5b862d37fdc34379"
age: 2999
x-amz-request-id: 7QJZQ4AD5VZZWFDG
cf-ray: 9321d6764ad51c50-AKL
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 02 Apr 2025 08:25:26 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 267ms
134ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qwxz.buymojatom.com
URL: https://qwxz.buymojatom.com/b8yljqb74n4pxypvd3xy66rmiRV2JVT3FKZzQ2S3NaT1U3SGY3VTItMjYyNi0yNjc4NjAyNi0wZmZlMDI3Ni0zNjkwLW91b2dNNDhlRVJtM0FubVliUXdZ/wflymo4mxb977dpo0c8x95gaevnzoosgu/wnpcgn
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Fri, 18 Apr 2025 05:57:14 GMT
accept-ranges: bytes
content-length: 5252
date: Fri, 18 Apr 2025 05:42:14 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
564 B 253ms
251ms XHR
application/json 18.142.20.179
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.142.20.179 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-142-20-179.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 2b470301850887838cd26a5698a206f8f64b7bd361112f74b4487bcb4e2320fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: application/json;charset=utf-8

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 251ms
251ms Fetch
text/plain 2404:6800:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54g3v9102396898za200zb9101576445&_p=1744954932795&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509156~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=1494852250.1744954934&ul=en-nz&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744954934&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.buymojatom.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1744954932795&tfd=2944
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4006:809::200e Sydney, Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:14 GMT
content-type: text/plain
server: Golfe2

POST
H3 200 e15f009328de669308b3bf5585c31c2469ec20f64950e9f9e5 Show response
faucetfoot.com/create/8a02db7dfdb028f8/ 299 B
323 B 481ms
221ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/create/8a02db7dfdb028f8/e15f009328de669308b3bf5585c31c2469ec20f64950e9f9e5

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/public/js/41dc2f87ded629d7d50d348fec190978d7d6754a055119da.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

a72f0aed57f8c8ecf4395b89405d3e6402536e832b1a06bf4ae008ab895d9253

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-asia-east1-spot-fpd7.gce-asia-east1, 1.1 google
expires: Fri, 18 Apr 2025 05:42:13 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 764ms
250ms XHR
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 778ms
253ms XHR
application/json 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
293 B 1019ms
339ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

63215e272ea5e617879e940625668af619239b91501795a337ad9ad62e257f6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H3 200 ima_ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 67 B
59 B 179ms
179ms XHR
application/json 172.217.24.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fpaint.toys%2Foil%2F

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.24.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

641768f2d1d19839fc3cecfa5158382fa0d332d5e49e31bcaafbedc4af91995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 05:42:14 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 35
date: Fri, 18 Apr 2025 05:42:14 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 72ms
72ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Fri, 18 Apr 2025 05:57:14 GMT
accept-ranges: bytes
content-length: 17042
date: Fri, 18 Apr 2025 05:42:14 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 627ms
155ms XHR
application/json 2406:da18:a99:1b02:bd8d:f79f:23a1:e894
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2406:da18:a99:1b02:bd8d:f79f:23a1:e894 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 06:12:15 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json
vary: Origin
server: nginx

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 1FF3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

269 B
379 B

309ms
80ms

Document
text/html

184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Fri, 18 Apr 2025 05:42:15 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Apr 2025 05:42:15 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
server: AkamaiGHost

GET
H2 200 AGSKWxXPFf3qfnkEM-mEmgh50bAjYFAcW4ZP9Xz4hLr5zenmkRp01HcsAnxEwWuLtlbZYz4FJF_6-ON_9od47LpduiBxVrDFW4wrjkKw2ii-W8omgNREc0ppQ-cGJTgoQQR_846ij9McDg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 308ms
307ms Script
application/javascript 2404:6800:4006:814::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXPFf3qfnkEM-mEmgh50bAjYFAcW4ZP9Xz4hLr5zenmkRp01HcsAnxEwWuLtlbZYz4FJF_6-ON_9od47LpduiBxVrDFW4wrjkKw2ii-W8omgNREc0ppQ-cGJTgoQQR_846ij9McDg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTU0OTM1LDQ2MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsInpaR1NGeGhDLXpJIl0sWzksImVuLUdCIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInF3eHouYnV5bW9qYXRvbS5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.zZGSFxhC-zI.es5.O/d=1/rs=AJlcJMxsQeoWoarFvoScLZ_Dcgr8ZL-xNA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:814::200e Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7b55accda4675c9e0304102d071e4dc1df59dad8274d832cd3e7a9aff367bfd9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-lkyP_PT2N_0sFCTS6ffx0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmLw1ZBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4ubYfqb9AJvAi29nw5U0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDUwMzfQMDOMLDABulDQB"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-lkyP_PT2N_0sFCTS6ffx0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 4C61 101 KB
28 KB 253ms
81ms Document
text/html 172.217.24.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.24.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af8c669f941e754271c71ba5714ac0e5247ce6c3d1b1638257e1b2862d33beaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1272
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28941
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:21:03 GMT
expires: Fri, 18 Apr 2025 06:11:03 GMT
last-modified: Mon, 14 Apr 2025 19:44:10 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 386ms
68ms Script
application/javascript 2600:9000:277c:ce00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:277c:ce00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 3563
x-cache: Hit from cloudfront
x-amz-cf-id: U4MwR55Wc_BygjLvRWrEAb0-cF61g1wQ8PxpWDN1VehuGVKQ1Y3cww==
date: Fri, 18 Apr 2025 04:42:53 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 9c9c7e612d1d6c87f0238098c1c16662.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: SYD3-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 262ms
82ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 63224
x-goog-stored-content-encoding: gzip
expires: Fri, 17 Apr 2026 12:08:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Thu, 17 Apr 2025 12:08:31 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyItuiTJUAjpeN06vSfA7Awn4-wEJEko2guslXTTobCAs1ApamZJh0gA4Bg9rWcGvYIW0
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 582ms
401ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 2a11718317ad6b4004e0d1d4ec3323d0

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 173ms
47ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 39013
cf-ray: 9321d67909e9d992-AKL
expires: Mon, 21 Apr 2025 05:42:15 GMT
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 1864ms
1146ms Script
text/javascript 2406:2600:7:100::2d
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::2d , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Sat, 19 Apr 2025 05:42:16 GMT
access-control-allow-origin: *
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 503ms
167ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 18 Apr 2025 05:42:14 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 204032
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 339ms
337ms Fetch
text/plain 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
292 B 787ms
338ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

8a250158939e1f97f2e9f74bb2b303dad7d8ee57d2a4a0190c64f19752ed12af

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H3 200 AGSKWxWZ7oT3YxF1YgRlI30LOK7jKunSmwJpDNja0Ezjl2_Yrk4g86tnBk0oqaRgNaWnUz6lJ9D8OXtZPzSLYrG8QKTkVAOHvmim9d3KVDroSjat_skKeantOIfRiZA_KrShZvxa6owAsw== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 230ms
230ms Script
application/javascript 172.217.167.110
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWZ7oT3YxF1YgRlI30LOK7jKunSmwJpDNja0Ezjl2_Yrk4g86tnBk0oqaRgNaWnUz6lJ9D8OXtZPzSLYrG8QKTkVAOHvmim9d3KVDroSjat_skKeantOIfRiZA_KrShZvxa6owAsw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTU0OTM1LDM2MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwielpHU0Z4aEMtekkiXSxbOSwiZW4tR0IiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXd4ei5idXltb2phdG9tLmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ea9916944e978ef3b04aebc042ee81fcbf26717e522c65a9dfbcaddb8c40b682

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-G_f33VY1Q4QWvhqkAMvZxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmII1JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4uHYfqb9AJvAj21PXjEqaSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRqYGJrpGRjGFxgAAKtUNIE"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-G_f33VY1Q4QWvhqkAMvZxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
12 KB 1062ms
1061ms Fetch
text/plain 172.217.24.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4013251485508743&correlator=3244672348809354&eid=31090594%2C31085777%2C95355264%2C83321073%2C31086810&output=ldjh&gdfp_req=1&vrg=202504150101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1744954935399&lmt=1744954935&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=720&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.buymojatom.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=9&tps=9&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDJiZGVlNTUxLWNkMGUtNDlmMi1hNDEwLTM1NTcyMGZhNGJkZVgBEh0KDmVzcC5jcml0ZW8uY29tGI6OrbvkMkgAUgIIZBIYCgl5YWhvby5jb20YjY6tu-QySABSAghkEhQKBW9wZW54GJ-QrbvkMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Yjo6tu-QySABSAghkEhcKCHJ0YmhvdXNlGI2OrbvkMkgAUgIIZBJTCg1jcndkY250cmwubmV0EkA2NDZhNTcyMjQwOTJkYWU0NzQ4YTM3OTkyNTJlMTg1Y2EwMmNmZWU1NGRlNDc1NjdjZDlmYTY4Yzk3NzY0NmVhWAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1744954932773&idt=1180&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Db635dd21b4a5427c8a753c43705fc2e354933965%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_format_grid%3Dbanner%26hb_size_grid%3D160x600%26hb_pb_grid%3D0.25%26hb_adid_grid%3D13473eef33d0242f%26hb_bidder_grid%3Dgrid%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.25%26hb_adid%3D13473eef33d0242f%26hb_bidder%3Dgrid%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.buymojatom.com%252F%26tyche_code%3DV.20250415.1%26pageos_code%3DV.20250415.1%26config_id%3D1024872_74068_primary_config%26hour%3D17%26day%3DFriday%26referrer_domain%3Dqwxz.buymojatom.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250415.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&pbbce=1&td=1&egid=28227&tan=b7d7275c-d732-4eed-ae3e-d9ea1f39313f&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.24.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3bb0c056c747bf29aa85bad5bf4d525da1860f33eb7d9400a5edecc659de14ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 11757
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 2A16 7 KB
3 KB 476ms
178ms Document
text/html 142.250.66.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.66.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s15-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:42:15 GMT
expires: Fri, 18 Apr 2025 05:42:15 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame B197 3 KB
4 KB 253ms
253ms Document
text/html 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

8c456b62cf42d11343e922e9c37d195db10428cf2beb625afd403732b1e0ad17

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 3440
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 18 Apr 2025 05:42:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 8V1FVQQFCQ5ZCZ4JG9QV

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
705 B 313ms
251ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 3e8f7e1a19af96dd5d52a8cbaf9aa1d43c168b50803c31240a3c66df957bf5e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 310ms
249ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 310ms
249ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 310ms
249ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 1FF3 43 KB
11 KB 70ms
70ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 97aad7b249a02fec12a538941cf194e76fb2c0955cdf070385ffc54d0d65cb39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

Response headers

cache-control: max-age=14497
content-encoding: gzip
expires: Fri, 18 Apr 2025 09:43:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Fri, 18 Apr 2025 05:42:15 GMT
last-modified: Thu, 17 Apr 2025 09:43:45 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 71ms
71ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Fri, 18 Apr 2025 05:57:15 GMT
accept-ranges: bytes
content-length: 67550
date: Fri, 18 Apr 2025 05:42:15 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 590ms
411ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: d327edc16374f7e8ff0146a41cfd2f2ebdf323ad78c5f799966ec4d9e93f5436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/json
x-cloud-trace-context: 111d740dfceabf96aaa1957854659b7a
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3CB6 20 KB
7 KB 72ms
72ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=99876
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Fri, 18 Apr 2025 05:42:15 GMT
expires: Sat, 19 Apr 2025 09:26:51 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B197
Redirect Chain

https://ssp-sync.criteo.com/user-sync/amazon/redirect?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24UID
https://dis.criteo.com/dis/usersync.aspx?r=73&p=362&dis=0&url=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fredirect%3fuid%3d%40%40CRITEO_USERID%40%40%26dised%3dtrue%26gdpr%3d%26gdprapplies%3dFal...
https://ssp-sync.criteo.com/user-sync/redirect?uid=db93ac75-8746-43c0-92a0-71c4af457d65&dised=true&gdpr=&gdprapplies=False&ccpa=&gpp=&gpp_sid=&profile=362&redir=https%253A%252F%252Fssp-sync.criteo....
https://x.bidswitch.net/sync?ssp=criteo&custom_data=tVeOPV9RWUQxM01SSkx1RTkwUHJwN1UzQ2RVJTJGMHh3JTJCTDhiQTBLSzNETlVCUnZjbnVNNktJTks4cmd5OCUyQlNnd3hlaHVOajd1Z0lzSmsxT2U1VUNSWnFkN1VCdyUyRmxDS1BsaTU5d...
https://ssp-sync.criteo.com/user-sync/match?p=tVeOPV9RWUQxM01SSkx1RTkwUHJwN1UzQ2RVJTJGMHh3JTJCTDhiQTBLSzNETlVCUnZjbnVNNktJTks4cmd5OCUyQlNnd3hlaHVOajd1Z0lzSmsxT2U1VUNSWnFkN1VCdyUyRmxDS1BsaTU5dWcwMjA...
https://ssp-sync.criteo.com/user-sync/amazon/redirect/complete?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=

43 B
479 B

259ms
259ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 68KTCR18HEPW4078HPDJ
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:18 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=31536000; preload;
location: https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

GET
H2

200

cs
cs.yellowblue.io/ Frame B197
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1744954936428
https://ad.turn.com/r/cs?pid=45&id=RX-b554a603-43b7-4855-a5d6-ff91194671d3-004&rndcb=4198226665
https://sync.1rx.io/usersync/turn/8700763480298571375?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-8958192e-e5ed-4d36-a611-019135af8b63-004?redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11599%26id%3DRX-8958192e-e5ed-4d36-a611-019135af8b63-004
https://cs.yellowblue.io/cs?aid=11599&id=RX-8958192e-e5ed-4d36-a611-019135af8b63-004

0
345 B

179ms
178ms

Image
application/javascript

44.227.34.128
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11599&id=RX-8958192e-e5ed-4d36-a611-019135af8b63-004
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 44.227.34.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-34-128.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: cs.yellowblue.io
content-length: 0
date: Fri, 18 Apr 2025 05:42:18 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11599&id=RX-8958192e-e5ed-4d36-a611-019135af8b63-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Fri, 18 Apr 2025 05:42:17 GMT
etag: RX8958192ee5ed4d36a611019135af8b63004
content-type: text/html

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B197
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3879565357135512000V10

43 B
479 B

257ms
257ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3879565357135512000V10

Requested by

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: Z5VXXXCS37S6K3P5JFY3
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3879565357135512000V10
Pragma: no-cache
Connection: keep-alive
Expires: Fri, 18 Apr 2025 05:42:15 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Date: Fri, 18 Apr 2025 05:42:15 GMT
Content-Type: text/html
Server: Apache

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B197
Redirect Chain

https://match.prod.bidr.io/cookie-sync/amzn?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID
https://match.prod.bidr.io/cookie-sync/amzn?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID&_bee_ppp=1
https://s.amazon-adsystem.com/ecm3?id=AAEH6U7QA8wAAB5KLqIXTg&ex=beeswax.com

43 B
479 B

257ms
257ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=AAEH6U7QA8wAAB5KLqIXTg&ex=beeswax.com

Requested by

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: M78ZJSNYEDNND61K7M9A
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://s.amazon-adsystem.com/ecm3?id=AAEH6U7QA8wAAB5KLqIXTg&ex=beeswax.com
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:16 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B197
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=M9MD44LC-1Q-HO4B&ex=d-rubiconproject.com&status=ok

43 B
479 B

263ms
262ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=M9MD44LC-1Q-HO4B&ex=d-rubiconproject.com&status=ok

Requested by

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 8FBGR62ZCPTRNTF1HHCR
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=M9MD44LC-1Q-HO4B&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e2b6b837307e4a2cb84d126fbaf2cea2
content-length: 0
Content-Type: text/html

GET
H2 200 101959
jadserve.postrelease.com/suid/ Frame B197 43 B
534 B 701ms
175ms Image
image/gif 52.33.32.182
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/101959?ntv_r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dnativo.com%26id%3DNTV_USER_ID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.33.32.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-33-32-182.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin: *
content-length: 43
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
server: nginx

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B197
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://b1sync.outbrain.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&s=2
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&obuid=bacf2483-a00e-4aa2-8099-2f5dc66f7421&s=2
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=bacf2483-a00e-4aa2-8099-2f5dc66f7421

43 B
479 B

258ms
257ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=bacf2483-a00e-4aa2-8099-2f5dc66f7421

Requested by

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 6KGEERTVMX9C5V2745M4
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=bacf2483-a00e-4aa2-8099-2f5dc66f7421
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 117
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: text/html; charset=utf-8

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame CA31 3 KB
1 KB 250ms
241ms Document
text/html 18.142.149.22
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.142.149.22 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-142-149-22.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1cc09924dc4ce6cf8d9bc56d9b69e6842b515b738671f84536fc5ded419b24b4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 18 Apr 2025 05:42:15 GMT
etag: W/"0713adf0c7753ea868bf3ecd9ae0d81b6"
server: nginx
timing-allow-origin: *

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 5810
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
1 KB

235ms
235ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc30333b03394fde3152f64f54e935032a0575a71e347c17b49f0ff6325c5bb8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9321d67dce9fd99a-AKL
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q%2BEXDKgs4IT%2FZ6APQx63mktCCtcjbqatBR3%2BHV2VrPkVIjVHSiVFW2cyWso7VfbonBPB4TOeqW4V6tU%2FGIzfWWXGU3A1u1L%2FY4Xtv2IvdZfbKGWujD3%2F0bDP95Qz9VC47OywMDJku3tuYA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9321d67cbc46d99a-AKL
content-length: 0
date: Fri, 18 Apr 2025 05:42:15 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VIRAEu7p694muz4HwIVfyBKn3WExYp6HqljA%2BugIYoqzJdc4iKba%2Fb7q1OZOEzS80WHQcrkK8wTlwD04Q0c0189GJ2OBz5PCtVKhJgh%2BaaHDsaQj8bax%2F6kkjWDOfb3yRxPd75YXllOZXw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 4720
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

714 B
940 B

167ms
166ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: f01b34c0a76b2a1b71d14dfa1ba262263f716576787d8b1ae5dd03db6369495b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 714
content-type: text/html
date: Fri, 18 Apr 2025 05:42:15 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.75.11.91

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 18 Apr 2025 05:42:15 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.75.11.91

GET
H2

200

sync Show response
sync.inmobi.com/ Frame 779D
Redirect Chain

https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true

6 KB
2 KB

269ms
268ms

Document
text/html

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: 2b173fa5c1fa1cfe30b0bd17bbc97e2c7b3bfa9a1befdee4b01f94ca22c85074

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 18 Apr 2025 05:42:16 GMT
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Accept-Encoding
x-envoy-upstream-service-time: 0

Redirect headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
location: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time: 0

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame EECD 781 B
993 B 761ms
242ms Document
text/html 54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

13292691199b020e2aa4d3c3be044423a583882230e26eba4d89d912860bac06

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 781
strict-transport-security: max-age=16000000; includeSubDomains; preload;

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame CE34 20 KB
7 KB 77ms
73ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=99876
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Fri, 18 Apr 2025 05:42:15 GMT
expires: Sat, 19 Apr 2025 09:26:51 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 tamptsync Show response
sync-amz.ads.yieldmo.com/ Frame B344 1 KB
1 KB 813ms
245ms Document
text/html 52.76.157.162
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.157.162 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-157-162.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: fb087d629b5424777b7ef559561c855dd3724305d0e2471ec925ee1cf0727ff1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers: Cache-Control, Pragma, *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Fri, 18 Apr 2025 05:42:16 GMT
pragma: no-cache
vary: accept-encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame DFD5
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4067672659384663562784

43 B
479 B

326ms
255ms

Document
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4067672659384663562784

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 18 Apr 2025 05:42:16 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: AK9CFPPGBKCV2YXZBFJF

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4067672659384663562784
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame E1AC 812 B
1 KB 576ms
179ms Document
text/html 44.227.34.128
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.227.34.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-34-128.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: fa03cfdf4b4bd9ca4c776604b8187c6fa0fe7ef8ecd8a77dfa3b9622d095658a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 812
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 3CB6 2 KB
3 KB 470ms
151ms Script
text/html 207.65.33.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=10342059&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 739d6248563d5500de27b26e66f54bc0aa6e76f23df5f3ad1f4c11fdda1f3da3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 338ms
337ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

5d5f3e4896f6219bbef4861e8322cd3f9fe722f427dcb1ed721e8283ca9b1d68

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: application/json
vary: Origin

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 250ms
250ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=765b8956-0a4b-4473-87e4-ffe6239f5f1e&ccsid=32cedfba-2d52-46f6-bc74-fd3d1f4895d7
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 14 KB
4 KB 251ms
251ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: eaa7e3d32d237bf9271ddb57b4068ec273bea7ce8efcf3b3eb36f3b6b5b31206

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Fri, 18 Apr 2025 05:42:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 264ms
250ms Image
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=ee626d99-3404-4ac1-973f-d7c6edd42691&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qwxz.buymojatom.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=a5baae55-a152-4543-8e26-0ec2919508bd&ccuid=765b8956-0a4b-4473-87e4-ffe6239f5f1e&sid=32cedfba-2d52-46f6-bc74-fd3d1f4895d7&nct=1744954936000&r=https%3A%2F%2Fqwxz.buymojatom.com%2F&ns=true&lang=en-NZ&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&devicefp=103.75.11.91%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=ab40124e-c386-42f6-a3a8-30b8b02ce083&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Fri, 18 Apr 2025 05:42:16 GMT
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame CA31
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=6875541723614500951

35 B
250 B

975ms
246ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=6875541723614500951
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Fri, 18 Apr 2025 05:42:17 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: no-store, no-cache, private
location: https://usersync.gumgum.com/usersync?b=apn&i=6875541723614500951
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 1047.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: bb4d2bb6-dc13-4dae-95ec-0e69d08755f1
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

sync
odr.mookie1.com/t/v2/ Frame CA31
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_4e531af1-81a8-43bd-a074-56a4a252b62e&gdpr=&gdpr_consent=&us_privacy=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=&ssp=gumgum2&gdpr=&gdpr_consent=

42 B
204 B

392ms
218ms

Image
image/gif

34.111.79.67
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=&ssp=gumgum2&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Server: 34.111.79.67 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 67.79.111.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

etag: "6530c7b4-2a"
via: 1.1 google
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
last-modified: Thu, 19 Oct 2023 06:07:48 GMT
server: nginx

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=&ssp=gumgum2&gdpr=&gdpr_consent=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame CA31
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_=%7BCACHEBUSTER%7D&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=a3e0b5fc-4f37-4f92-81df-25dba38e2445

35 B
250 B

987ms
248ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=a3e0b5fc-4f37-4f92-81df-25dba38e2445
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Fri, 18 Apr 2025 05:42:17 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://usersync.gumgum.com/usersync?b=opx&i=a3e0b5fc-4f37-4f92-81df-25dba38e2445
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame CA31
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=riWSHH3bXZVjXaja77ZtlWdLC1s

35 B
250 B

671ms
245ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=riWSHH3bXZVjXaja77ZtlWdLC1s
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Fri, 18 Apr 2025 05:42:17 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=riWSHH3bXZVjXaja77ZtlWdLC1s
Content-Length: 99
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame CA31
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-3DVqe3ZE2pdhJApnip9XBrhk.TZ81Rulq5xK~A

35 B
250 B

1104ms
244ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-3DVqe3ZE2pdhJApnip9XBrhk.TZ81Rulq5xK~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Fri, 18 Apr 2025 05:42:17 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://usersync.gumgum.com/usersync?b=oth&i=y-3DVqe3ZE2pdhJApnip9XBrhk.TZ81Rulq5xK~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame CA31
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%...
https://usersync.gumgum.com/usersync?b=vnt&i=03cf6274-3a3d-429b-9b30-e803cf9d6039

35 B
250 B

578ms
244ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=03cf6274-3a3d-429b-9b30-e803cf9d6039
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Fri, 18 Apr 2025 05:42:17 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

X-CI-RTID: b2a7da61-79b4-4431-9a86-5b918e8f5548
Location: https://usersync.gumgum.com/usersync?b=vnt&i=03cf6274-3a3d-429b-9b30-e803cf9d6039
Content-Length: 108
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 142
match.deepintent.com/usersync/ Frame CA31 0
44 B 693ms
228ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

date: Fri, 18 Apr 2025 05:42:16 GMT
server: c
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame CA31
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_4e531af1-81a8-43bd-a074-56a4a252b62e&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://b1sync.outbrain.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=&gdpr_consent=&puid=a_4e531af1-81a8-43bd-a074-56a4a252b62e&s=2&us_privacy=
https://b1sync.zemanta.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=&gdpr_consent=&obuid=28267165-03df-4a76-b72b-c8129353e9de&puid=a_4e531af1-8...
https://usersync.gumgum.com/usersync?b=zem&i=28267165-03df-4a76-b72b-c8129353e9de

35 B
250 B

246ms
245ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=28267165-03df-4a76-b72b-c8129353e9de
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Fri, 18 Apr 2025 05:42:17 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://usersync.gumgum.com/usersync?b=zem&i=28267165-03df-4a76-b72b-c8129353e9de
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 108
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame CA31
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&us_privacy=&gpp=&gpp_sid=&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=vlKRQBkacu0c&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355

35 B
208 B

253ms
241ms

Image
image/gif

18.142.149.22
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=vlKRQBkacu0c&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Server: 18.142.149.22 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-142-149-22.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
expires: 0
content-length: 35
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif;charset=UTF-8
server: nginx

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://rtb.gumgum.com/usersync?b=pln&i=vlKRQBkacu0c&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-bbfcf7f8d-8dv9w
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-NZ
server: Jetty(12.0.17)

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame CA31
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=3088813447748523663

35 B
250 B

878ms
245ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=3088813447748523663
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Fri, 18 Apr 2025 05:42:17 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: no-cache,no-store
location: https://usersync.gumgum.com/usersync?b=sad&i=3088813447748523663
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 18 Apr 2025 05:42:15 GMT
pragma: no-cache

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame CA31 43 B
479 B 291ms
256ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=a_4e531af1-81a8-43bd-a074-56a4a252b62e

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 0HHSJK1FQJ02CWQ253BJ
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F4D0
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1301&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=adf&i=1962616590014284432&gdpr=&gdpr_consent=

35 B
250 B

564ms
246ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=adf&i=1962616590014284432&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 18 Apr 2025 05:42:17 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: -1
location: https://usersync.gumgum.com/usersync?b=adf&i=1962616590014284432&gdpr=&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame 8700 170 B
243 B 442ms
181ms Document
image/png 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV80ZTUzMWFmMS04MWE4LTQzYmQtYTA3NC01NmE0YTI1MmI2MmU=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-0-66-37.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B321 20 KB
7 KB 69ms
69ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=99875
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: Sat, 19 Apr 2025 09:26:51 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame E8C3
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=06841cff-44c8-430f-962a-95e1e48ff5fa

35 B
250 B

984ms
245ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=06841cff-44c8-430f-962a-95e1e48ff5fa
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 18 Apr 2025 05:42:17 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 193
date: Fri, 18 Apr 2025 05:42:16 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=06841cff-44c8-430f-962a-95e1e48ff5fa
server: Kestrel

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 5D13
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=aAHmOMCo8XwAAI4I.j8AAAAA

35 B
250 B

829ms
246ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=aAHmOMCo8XwAAI4I.j8AAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 18 Apr 2025 05:42:17 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:16 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=aAHmOMCo8XwAAI4I.j8AAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad94.dc4p.scaleout.jp
X-SO-IP: 103.75.11.91
X-SO-Key: aAHmOMCo8XwAAI4I.j8AAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"103.75.11.91","key":"aAHmOMCo8XwAAI4I.j8AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad94"}
X-SO-LB-Hostname: m-tgng24.dc4p.scaleout.jp
X-SO-Upstream-ID: m-ad94

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F446
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=s9HESh1bTvxZNQqyHHJKvM9C4geM3LSCBd-StgdA0oQ&pi=gumgum&tc=1

35 B
250 B

281ms
250ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=s9HESh1bTvxZNQqyHHJKvM9C4geM3LSCBd-StgdA0oQ&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 18 Apr 2025 05:42:17 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT Fri, 18 Apr 2025 05:42:17 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=s9HESh1bTvxZNQqyHHJKvM9C4geM3LSCBd-StgdA0oQ&pi=gumgum&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 8985
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

269 B
379 B

89ms
88ms

Document
text/html

184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 / Show response
d0.eu-3-id5-sync.com/ 1 B
143 B 1010ms
324ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-3-id5-sync.com/ 1 B
143 B 1029ms
340ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-3-id5-sync.com/ 1 B
143 B 1024ms
338ms Fetch
text/plain 51.195.34.220
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.220 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip220.ip-51-195-34.eu
Software: /
Resource Hash: 559aead08264d5795d3909718cdd05abd49572e84fe55590eef31a88a08fdffd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-3-id5-sync.com/ 1 B
143 B 1027ms
338ms Fetch
text/plain 135.125.146.86
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.146.86 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip86.ip-135-125-146.eu
Software: /
Resource Hash: 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-3-id5-sync.com/ 1 B
143 B 1028ms
339ms Fetch
text/plain 51.195.73.74
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.74 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip74.ip-51-195-73.eu
Software: /
Resource Hash: d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-3-id5-sync.com/ 1 B
143 B 1023ms
337ms Fetch
text/plain 51.195.126.30
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.126.30 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip30.ip-51-195-126.eu
Software: /
Resource Hash: 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-3-id5-sync.com/ 1 B
143 B 1023ms
337ms Fetch
text/plain 51.195.73.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.82 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip82.ip-51-195-73.eu
Software: /
Resource Hash: e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-3-id5-sync.com/ 1 B
143 B 1005ms
329ms Fetch
text/plain 51.195.127.100
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.100 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip100.ip-51-195-127.eu
Software: /
Resource Hash: f67ab10ad4e4c53121b6a5fe4da9c10ddee905b978d3788d2723d7bfacbe28a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d0.eu-4-id5-sync.com/ 1 B
143 B 1023ms
335ms Fetch
text/plain 135.125.146.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.146.82 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip82.ip-135-125-146.eu
Software: /
Resource Hash: 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-4-id5-sync.com/ 1 B
143 B 1026ms
339ms Fetch
text/plain 51.195.127.100
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.100 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip100.ip-51-195-127.eu
Software: /
Resource Hash: f67ab10ad4e4c53121b6a5fe4da9c10ddee905b978d3788d2723d7bfacbe28a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-4-id5-sync.com/ 1 B
143 B 1022ms
338ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-4-id5-sync.com/ 1 B
143 B 1026ms
340ms Fetch
text/plain 51.195.73.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.82 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip82.ip-51-195-73.eu
Software: /
Resource Hash: e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-4-id5-sync.com/ 1 B
143 B 1020ms
334ms Fetch
text/plain 51.195.115.36
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.115.36 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip36.ip-51-195-115.eu
Software: /
Resource Hash: 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-4-id5-sync.com/ 1 B
143 B 1021ms
335ms Fetch
text/plain 51.195.127.115
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.115 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip115.ip-51-195-127.eu
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-4-id5-sync.com/ 1 B
143 B 1024ms
337ms Fetch
text/plain 51.195.73.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.82 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip82.ip-51-195-73.eu
Software: /
Resource Hash: e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-4-id5-sync.com/ 1 B
143 B 1024ms
336ms Fetch
text/plain 135.125.140.162
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.140.162 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip162.ip-135-125-140.eu
Software: /
Resource Hash: 3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 1FF3 7 B
1 KB 1012ms
242ms XHR
application/json 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 030b4ddd4a4f3e9891a065664f20c4bb
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 5810
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&expiration=1747546936&gdpr=0&gdpr_consent=

43 B
341 B

184ms
184ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&expiration=1747546936&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0QYWYwH6%2B55FXtBrQ2ys0LSKYI9qEEcRNOzLpvaIUNI1gAAJZGtUkXbWwNCNSq%2FqS%2FKU7xsacCd%2BIJXwno5DudGI%2F7Bp2vMjuLnzUY7HtateZwroxnMkYXiIeGoAhhI2WX1jyIUkJEVcDw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9321d6801e91725f-AKL
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&expiration=1747546936&gdpr=0&gdpr_consent=
content-length: 323
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET
H2

200

crum
dsum-sec.casalemedia.com/ Frame 5810
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAHmN4sFVewAMcb2AJVc0gAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1

43 B
332 B

170ms
170ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zXLb%2BzIa8Z1KVt8f%2F%2BIpLuCoOHyN7vxbiqSlcmHIlzk798d2IffvUX7lpJCujk%2FlaH9q2tTIEeesgX4hClb2KTHLDCe4HPQIJ66LCk1GSPlKDFu%2BqTohOnx%2BTtkFV5HD169SkUGGFzng%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9321d6822819725f-AKL
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK 31327
i.liadm.com/s/ Frame 5810 0
208 B 1169ms
250ms Image
text/plain 52.0.66.37
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aAHmN4sFVewAMcb2AJVc0gAA%264916&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.66.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:17 GMT
trace-id: 248ef3c164fed6ea
Request-Time: 0
Connection: keep-alive

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 5810
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aAHmN4sFVewAMcb2AJVc0gAAEzQAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKEiGvENqyOQaxwfw_nn11Q&google_cver=1

43 B
764 B

183ms
180ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKEiGvENqyOQaxwfw_nn11Q&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rwbygf2phT%2FC%2FY%2FHI6JRNmAAeZ7EU5ET%2FBkTBLO98TwU2PjaSToei5lsfdPWHT5GWFUE4O2gn5M4DHnPBY6o6M6d0IzVTvpbVirgQW7x3FtOxhdOZqp7uMtXel1fCWEIxbtVAdiYTxN56w%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9321d6816eddd99a-AKL
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKEiGvENqyOQaxwfw_nn11Q&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 364
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5810
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6122265887325034171&gdpr=0&gdpr_consent=

43 B
798 B

171ms
171ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6122265887325034171&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKvZ98XSc4CuQSineulFhMk2R3%2F52Lylw8oTH3VnqcNwYrmxTUyTNXFwcT8KDMYxtp27lPZp79DIAKCfkx%2FHPlgEyHxLsKaeqEHplImmFFu00jeUrCRiyI58Iwk8ku3WDiw4l7pkbRUsew%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9321d683ab27d99f-AKL
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache,no-store
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6122265887325034171&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 18 Apr 2025 05:42:16 GMT
pragma: no-cache

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5810
Redirect Chain

https://trace.mediago.io/ju/cs/indexexchange
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=8313d59a917c48452tjubb00m9md46e4

43 B
769 B

168ms
168ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=8313d59a917c48452tjubb00m9md46e4
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PgZI56RYm%2B872vcBZ9e53S6PpaRYQMbHQRNcd%2BnhvNQNyDZpucuNGjJwLrZAtyYQtYuQlm3hrdHCRZydGJUz%2F7%2FhV5HnT9XfxJeSrBQfKzKIGudC96XvWKcJHy%2Bg5Y91cERB%2Bh7MNYLIPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9321d684ddb1d99f-AKL
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=8313d59a917c48452tjubb00m9md46e4
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/plain; charset=utf-8
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 5810 43 B
855 B 264ms
261ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAHmN4sFVewAMcb2AJVc0gAAEzQAAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: FA7KWRZ6WXWTG5MQF3HD
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 5810 42 B
181 B 635ms
151ms Image
image/gif 2406:da18:22e:4f05:1e1b:bf68:36e7:6e92
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da18:22e:4f05:1e1b:bf68:36e7:6e92 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-transform,public,max-age=300,s-maxage=900
content-length: 42
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Cookie
server: nginx/1.22.1

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 5810 43 B
479 B 757ms
256ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=aAHmN4sFVewAMcb2AJVc0gAAEzQAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: HSVD396RDHRPWENZRA7K
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3 200 sponsored..homad. Show response
fundingchoicesmessages.google.com/f/AGSKWxVhzpSzTOpVw6pKfJoI_pEEAOc_KN9UILp8kW6aIo-kzjDSSATbY6Jg__BBTW72y8JSnyHAe37RNMtAoXeumfP_4fUT9EDrK4kvEqUf916wl7sTed-AYOAIkxKCSQpGsLA0_cEUVQi0rWJA1stjYqC5vvj-A... 54 B
109 B 194ms
192ms Script
application/javascript 172.217.167.110
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVhzpSzTOpVw6pKfJoI_pEEAOc_KN9UILp8kW6aIo-kzjDSSATbY6Jg__BBTW72y8JSnyHAe37RNMtAoXeumfP_4fUT9EDrK4kvEqUf916wl7sTed-AYOAIkxKCSQpGsLA0_cEUVQi0rWJA1stjYqC5vvj-AS0pqmiD-vPsphUNlJwwqtC5rEFvhcj8/_/gate-ad-/globalad./adnetwork468./images/sponsored..homad.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxsQeoWoarFvoScLZ_Dcgr8ZL-xNA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

832bac8c6dd0affe662c97ace02120d985d7f8eb3bb4ca0c66596f7e4553cff8

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-8uNvlMCp4Sm8ZjAhk1m-qA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmLw1pBiOHHrNtMFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkFeLh2HGm_QCbwISNsyczKmkk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkamBia6RkYxhcYAAD6aDh9"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-8uNvlMCp4Sm8ZjAhk1m-qA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
67 B 260ms
82ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxsQeoWoarFvoScLZ_Dcgr8ZL-xNA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 13036835877489095579
age: 36846
x-content-type-options: nosniff
expires: Thu, 01 May 2025 19:28:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 19:28:10 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 42
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUC2brbOxjLWxQE8X2zHDGFqXjPM68KIpat-uHIhkPVRxTNGmVGgIiCdvYQuFC4aOO5y_Sorj8i3w6ad_7cYooa11PmuvqRcwhGjBKd5y2gcZovERLBRzeK1SGP60l51AVQcoAmlQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 367ms
192ms XHR
text/html 172.217.167.110
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUC2brbOxjLWxQE8X2zHDGFqXjPM68KIpat-uHIhkPVRxTNGmVGgIiCdvYQuFC4aOO5y_Sorj8i3w6ad_7cYooa11PmuvqRcwhGjBKd5y2gcZovERLBRzeK1SGP60l51AVQcoAmlQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-FqCmnP9UvPq6lo6dQhxB2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAvxcOw4036ATWDCtTePGZVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJoZmegVl8gQEAf7Yk3g"
content-security-policy: script-src 'report-sample' 'nonce-FqCmnP9UvPq6lo6dQhxB2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 0CA3
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=

35 B
590 B

189ms
189ms

Document
image/gif

185.84.60.23
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.84.60.23 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

sync Show response
sync-pm.ads.yieldmo.com/ Frame C938
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:0a5b6801-e639-4e00-a98d-54fa513f839b&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=1668f7bb787c0a28&is_secure=true&networkId=17100&version=1&nuid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQACpUO8KCcV5wJLumeyAQEBAQEBAQCXRmpQuAEBAQEBAQEB&expiration=1745041337&nuid=E54DADAC-091C-44...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160648&pmc=1&pr=https%3A%2F%2Fsync-pm.ads.yieldmo.com%2Fsync%3Fpn_id%3Dpub%26id%3DE54DADAC-091C-44D7-B251-70AEC9DC0924%26gdpr%3D0%26gdpr_consent%3D
https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=

43 B
613 B

291ms
251ms

Document
image/gif

52.76.157.162
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.157.162 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-157-162.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: d346801abbf9bb4e9e9a055239053d4ab5596514304f601a6c70604187acb744

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers: Cache-Control, Pragma, *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
content-type: image/gif;charset=utf-8
date: Fri, 18 Apr 2025 05:42:18 GMT
pragma: no-cache

Redirect headers

cache-control: no-store, no-cache, private
date: Fri, 18 Apr 2025 05:42:18 GMT
location: https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A980
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6875541723614500951&gdpr=0&gdpr_consent=

42 B
218 B

152ms
150ms

Document
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6875541723614500951&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 05:42:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: e81529d2-d94f-412e-9f6f-dea5b14fc06a
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6875541723614500951&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 103.75.11.91; 103.75.11.91; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 4B26 0
832 B 313ms
272ms Document
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=E54DADAC-091C-44D7-B251-70AEC9DC0924
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 9321d67fec6bd9a8-AKL
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744954936&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ifKWpYnEeiA8dxuhtvAxEONzjFuufgUDyrxZChdr5ts%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744954936&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ifKWpYnEeiA8dxuhtvAxEONzjFuufgUDyrxZChdr5ts%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H2

200

sync
pippio.com/api/ Frame 3CB6
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=E54DADAC-091C-44D7-B251-70AEC9DC0924
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEU1NERBREFDLTA5MUMtNDRENy1CMjUxLTcwQUVDOURDMDkyNBAAGg0IuMyHwAYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=1ee936ee2501153c542ae52ca3abbde57140db669ae08fb8296a8ab9b849c88b791426b5417dce21&_=2

42 B
572 B

503ms
304ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=1ee936ee2501153c542ae52ca3abbde57140db669ae08fb8296a8ab9b849c88b791426b5417dce21&_=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&it=1&iv=1ee936ee2501153c542ae52ca3abbde57140db669ae08fb8296a8ab9b849c88b791426b5417dce21&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT

GET
H/1.1 200
OK info
uipglob.semasio.net/pubmatic/1/ Frame 3CB6 42 B
277 B 609ms
165ms Image
image/gif 95.173.218.112
CDN77 Datacamp Li...

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=E54DADAC-091C-44D7-B251-70AEC9DC0924&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.173.218.112 Praha 10, Czech Republic, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-95-173-218-112.datapacket.com
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Routing-Server-ID: -1
Frontend-ID: 3
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 42
UIP-Response-Status: FallbackResponse
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame 3CB6 49 B
222 B 757ms
252ms Image
image/gif 13.251.155.248
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.251.155.248 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-251-155-248.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3CB6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RTU0REFEQUMtMDkxQy00NEQ3LUIyNTEtNzBBRUM5REMwOTI0&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEP4wf_v35jT2DLrPJfm1itQ&google_cver=1

42 B
528 B

463ms
151ms

Image
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEP4wf_v35jT2DLrPJfm1itQ&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEP4wf_v35jT2DLrPJfm1itQ&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 3CB6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5U2trAkcRNeyUXCuydwJJA%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEDLMQAjMfGdzImQSMzO1ius&google_cver=1

4 KB
4 KB

71ms
69ms

Image
text/html

23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEDLMQAjMfGdzImQSMzO1ius&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=99875
content-encoding: gzip
expires: Sat, 19 Apr 2025 09:26:51 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Fri, 18 Apr 2025 05:42:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEDLMQAjMfGdzImQSMzO1ius&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3CB6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEP4wf_v35jT2DLrPJfm1itQ&google_cver=1

42 B
378 B

616ms
151ms

Image
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEP4wf_v35jT2DLrPJfm1itQ&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEP4wf_v35jT2DLrPJfm1itQ&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3CB6
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:EF18C72F1B354775B80CF2AD67EB2817

42 B
248 B

152ms
152ms

Image
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:EF18C72F1B354775B80CF2AD67EB2817
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:EF18C72F1B354775B80CF2AD67EB2817
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Apr 2025 05:42:16 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 E54DADAC-091C-44D7-B251-70AEC9DC0924
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 3CB6 43 B
519 B 288ms
153ms Image
image/gif 2406:da18:929:5a00:13ca:a5b6:9cd6:a2cc
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/E54DADAC-091C-44D7-B251-70AEC9DC0924?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2406:da18:929:5a00:13ca:a5b6:9cd6:a2cc Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 3CB6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=

42 B
544 B

510ms
151ms

Image
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=
content-length: 355
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3CB6
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3295036552570422895&gdpr=0&gdpr_consent=&us_privacy=

1 B
242 B

152ms
151ms

Image
text/html

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3295036552570422895&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3295036552570422895&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Fri, 18 Apr 2025 05:42:16 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 3CB6
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=E54DADAC-091C-44D7-B251-70AEC9DC0924&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8W3GZiBE2uXlBE7QaVGLnYuNe_sOgxc-~A&gdpr=0

0
261 B

478ms
154ms

Image
text/plain

67.199.150.85
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8W3GZiBE2uXlBE7QaVGLnYuNe_sOgxc-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 67.199.150.85 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:17 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8W3GZiBE2uXlBE7QaVGLnYuNe_sOgxc-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html
server: ATS

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 8985 43 KB
0 70ms
70ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 97aad7b249a02fec12a538941cf194e76fb2c0955cdf070385ffc54d0d65cb39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum

Response headers

cache-control: max-age=14497
content-encoding: gzip
expires: Fri, 18 Apr 2025 09:43:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Fri, 18 Apr 2025 05:42:15 GMT
last-modified: Thu, 17 Apr 2025 09:43:45 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 4720 43 B
479 B 400ms
256ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=8cacb264-b569-c746-104c-22826a8cf8ea

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: MP5DHJ88F0M7VCVTEX0C
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 4720
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKIBA_g47mPAhLKcsmOf_5U&google_cver=1

43 B
61 B

173ms
170ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKIBA_g47mPAhLKcsmOf_5U&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKIBA_g47mPAhLKcsmOf_5U&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 4720 170 B
232 B 188ms
185ms Image
image/png 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZjgxNTFkZDMtNjBiNC0yMjE4LWM1YTItZmFhY2M4NWRmZDZh

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 4720
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AdQpsi7zLX5zks8AKGiYDT-SL88AAAGWR2tNvg

43 B
97 B

234ms
170ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AdQpsi7zLX5zks8AKGiYDT-SL88AAAGWR2tNvg
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AdQpsi7zLX5zks8AKGiYDT-SL88AAAGWR2tNvg
pragma: no-cache
via: 1.1 dc5b7b7a6895b629c6cb8eef5910309e.cloudfront.net (CloudFront)
expires: -1
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: iimDUIyFmd5afk5lw-h4W3dMal2z-ed7YGdLt8m7sOKDM8SK-OsWaA==
date: Fri, 18 Apr 2025 05:42:16 GMT
x-amz-cf-pop: SYD3-P2

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 4720
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAHmOMCo8XwAAI4I.k4AAAAA

43 B
136 B

211ms
168ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAHmOMCo8XwAAI4I.k4AAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

Cache-Control: private
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAHmOMCo8XwAAI4I.k4AAAAA
X-SO-LB-Hostname: m-tgng24.dc4p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"103.75.11.91","key":"aAHmOMCo8XwAAI4I.k4AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad271"}
X-SO-Cluster-ID: 0
X-SO-Upstream-ID: m-ad271
X-SO-HostName: m-ad271.dc4p.scaleout.jp
Connection: keep-alive
X-SO-IP: 103.75.11.91
X-SO-Key: aAHmOMCo8XwAAI4I.k4AAAAA
Content-Length: 0
P3P: CP="See also http://www.scaleout.jp/privacy/"
Date: Fri, 18 Apr 2025 05:42:16 GMT
X-SO-Ads-Time: 7
Server: nginx

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 4720
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=d47ace19-a9c3-7cbc-d042-a01502bf330a&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=06841cff-44c8-430f-962a-95e1e48ff5fa&ttd_puid=d47ace19-a9c3-7cbc-d042-a01502bf330a&gdpr=0&gdpr_consent=

43 B
62 B

167ms
167ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=06841cff-44c8-430f-962a-95e1e48ff5fa&ttd_puid=d47ace19-a9c3-7cbc-d042-a01502bf330a&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=06841cff-44c8-430f-962a-95e1e48ff5fa&ttd_puid=d47ace19-a9c3-7cbc-d042-a01502bf330a&gdpr=0&gdpr_consent=
content-length: 335
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET
H2

200

cs
cs.yellowblue.io/ Frame E1AC
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings
https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings&zcc=1&cb=1744954936504
https://ad.turn.com/r/cs?pid=45&id=RX-8958192e-e5ed-4d36-a611-019135af8b63-004&rndcb=2955453067
https://sync.1rx.io/usersync/turn/3295036552570422895?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-8958192e-e5ed-4d36-a611-019135af8b63-004?redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11599%26id%3DRX-8958192e-e5ed-4d36-a611-019135af8b63-004
https://cs.yellowblue.io/cs?aid=11599&id=RX-8958192e-e5ed-4d36-a611-019135af8b63-004

0
354 B

181ms
180ms

Image
application/javascript

44.227.34.128
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11599&id=RX-8958192e-e5ed-4d36-a611-019135af8b63-004
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.227.34.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-34-128.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Fri, 18 Apr 2025 05:42:18 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11599&id=RX-8958192e-e5ed-4d36-a611-019135af8b63-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Fri, 18 Apr 2025 05:42:17 GMT
etag: RX8958192ee5ed4d36a611019135af8b63004
content-type: text/html

GET
H2

200

cs
cs.yellowblue.io/ Frame E1AC
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=6875541723614500951

0
354 B

180ms
175ms

Image
application/javascript

44.227.34.128
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=6875541723614500951
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.227.34.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-34-128.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=6875541723614500951
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 40e4f18f-0951-4507-a221-22b1c10574b2
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

cs
cs.yellowblue.io/ Frame E1AC
Redirect Chain

https://match.sharethrough.com/universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422
https://cs.yellowblue.io/cs?aid=11587&uid=b00f8bb4-0754-4caa-8872-181b8f3ccd54&gdpr=0

0
354 B

184ms
177ms

Image
application/javascript

44.227.34.128
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=b00f8bb4-0754-4caa-8872-181b8f3ccd54&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.227.34.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-34-128.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cs.yellowblue.io/cs?aid=11587&uid=b00f8bb4-0754-4caa-8872-181b8f3ccd54&gdpr=0
content-length: 0

GET
H3 200 setuid
prebid.intergient.com/ Frame E1AC 0
760 B 282ms
281ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rise&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=7LwmFa29k
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744954936&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ifKWpYnEeiA8dxuhtvAxEONzjFuufgUDyrxZChdr5ts%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744954936&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ifKWpYnEeiA8dxuhtvAxEONzjFuufgUDyrxZChdr5ts%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9321d6804d5fd9a8-AKL
server: cloudflare

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame A943
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=Kg-WALZHOmIutDO_QxeutXy1

0
354 B

177ms
177ms

Document
application/javascript

44.227.34.128
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=Kg-WALZHOmIutDO_QxeutXy1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.227.34.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-34-128.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Fri, 18 Apr 2025 05:42:17 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=Kg-WALZHOmIutDO_QxeutXy1
vary: Accept-Encoding

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUC2brbOxjLWxQE8X2zHDGFqXjPM68KIpat-uHIhkPVRxTNGmVGgIiCdvYQuFC4aOO5y_Sorj8i3w6ad_7cYooa11PmuvqRcwhGjBKd5y2gcZovERLBRzeK1SGP60l51AVQcoAmlQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-SSQSUL0RS_shsDr670tZeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1pBi-FB_mfUHEAvxcOw4036ATWDFz8nvGJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJoZmegVl8gQEAe7Mkzg"
content-security-policy: script-src 'report-sample' 'nonce-SSQSUL0RS_shsDr670tZeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUC2brbOxjLWxQE8X2zHDGFqXjPM68KIpat-uHIhkPVRxTNGmVGgIiCdvYQuFC4aOO5y_Sorj8i3w6ad_7cYooa11PmuvqRcwhGjBKd5y2gcZovERLBRzeK1SGP60l51AVQcoAmlQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--OIr1-y17nh12tm6UyLt7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0JBi-FB_mfUHEAvxcOw4036ATaBj9qF-JiWXpPzC-OT8vJLUvBLdxJRiXRC7KDOptCS_CIWdWgZSkZOfnp6Zlx5vZGBkamBiaKZnYBZfYAAAS_0kJg"
content-security-policy: script-src 'report-sample' 'nonce--OIr1-y17nh12tm6UyLt7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUC2brbOxjLWxQE8X2zHDGFqXjPM68KIpat-uHIhkPVRxTNGmVGgIiCdvYQuFC4aOO5y_Sorj8i3w6ad_7cYooa11PmuvqRcwhGjBKd5y2gcZovERLBRzeK1SGP60l51AVQcoAmlQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-aS7Q4DN9U81yOh13YtszwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw1JBi-FB_mfUHEAvxcOw4036ATeDBo2f9TEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAAhO8k6g"
content-security-policy: script-src 'report-sample' 'nonce-aS7Q4DN9U81yOh13YtszwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxVOaUWSCcKYSEF0iOgDVgV_GbOHxydbhpHOVT18ZNrrBm7vR6ZC9h7jaZ9V-OgFLQt69DBn8jS9qfAW-2u7TswILtSIxKhz6YDbU73zIclwulcLMNXiXMDDMW6M4_-iWJTs1W9s9g== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 210ms
208ms Script
application/javascript 172.217.167.110
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVOaUWSCcKYSEF0iOgDVgV_GbOHxydbhpHOVT18ZNrrBm7vR6ZC9h7jaZ9V-OgFLQt69DBn8jS9qfAW-2u7TswILtSIxKhz6YDbU73zIclwulcLMNXiXMDDMW6M4_-iWJTs1W9s9g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTU0OTM2LDQ2NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ6WkdTRnhoQy16SSJdLFs5LCJlbi1HQiJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmJ1eW1vamF0b20uY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c262eac68a180227891c0d580629e92e8b68ebe35941845df7232fe936a2257d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-qLBUYHeyzC2hdu9suVSLZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmLw0ZBiOHHrNtMFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkFeLh2HGm_QCbwISHP6cyKWkk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkamBia6RkYxhcYAAAUpDkP"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-qLBUYHeyzC2hdu9suVSLZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 container.html Show response
536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 010F 7 KB
0 0ms
0ms Document
text/html 142.250.66.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.66.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s15-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:42:15 GMT
expires: Fri, 18 Apr 2025 05:42:15 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C6B5 52 KB
17 KB 257ms
76ms Document
text/html 23.46.179.27
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.46.179.27 Sydney, Australia, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-46-179-27.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 18 Apr 2025 05:42:16 GMT
ETag: "623de86a-cf34"
Expires: Sat, 19 Apr 2025 05:42:18 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2B95 20 KB
7 KB 69ms
69ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=99875
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: Sat, 19 Apr 2025 09:26:51 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame ADFE 16 KB
6 KB 1087ms
371ms Document
text/html 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

43fe7cc6db1c3739aeb83e2496de0dd49feaf3aeee148bbb99f2aabd682f9347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel
server-processing-duration-in-ticks: 272181
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 3567 544 B
772 B 269ms
168ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 9edf2cdd0751eb1f2282696cd8bc9c1bd2a22adab12ada9e4951897d88750947

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 544
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.75.11.91

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame B28F 3 KB
2 KB 218ms
44ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 583
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 9321d6826f971c5e-AKL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: Fri, 18 Apr 2025 09:42:16 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 6DEC 0
0 709ms
229ms Document
text/plain 147.182.184.103
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.182.184.103 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Fri, 18 Apr 2025 05:42:17 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 5145 269 B
379 B 71ms
68ms Document
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 7ACF 1 KB
2 KB 157ms
152ms Document
text/html 52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: 6004c492a529c5dd66c7cb2fa7ed49ba6239314b99ace54cf137c7fedc5bbd78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 05:42:16 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame FAFE 11 KB
5 KB 268ms
191ms Document
text/html 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde&linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744954934762&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f94bbf738afec765120f144c8ea3814342576d371e17fb93bf121c020b086456

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 9321d681dc861c50-AKL
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 05:42:16 GMT
expires: 0
last-modified: Wed, 16 Apr 2025 11:15:45 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 339ms
337ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
663 B 252ms
252ms Fetch
application/javascript 52.3.206.124
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.206.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-206-124.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: da30e30d8b559c8db79cec67ead10c1e3c0dcb4ebf847f8b8bce66d8e988754f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
0 0ms
0ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
date: Fri, 18 Apr 2025 05:42:13 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
0 0ms
0ms Fetch 52.22.201.236
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js3ppgdyqmnsz9hcga8dr3cx&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.201.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-201-236.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=3599, private
trace-id: 11212a231804ceaa
request-time: 6
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 06:42:14 GMT
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:14 GMT
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=ePPy8Xw3UnZUUFJqUHpoOUg1U0tLRjNLTzFPeWtOaHpJakc3Tml2bkRweTJ2WTRnaGJpbmZqL3NZYlpxZ1l1TzUydWJmSER0K1MwNzVLTUJMUjlja3lwcEZXOVRwRjdHTDhtRlgzZzFRWnVVbXRFWFdiUXVmVWFQMXg4VD...

370 B
928 B

159ms
158ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=ePPy8Xw3UnZUUFJqUHpoOUg1U0tLRjNLTzFPeWtOaHpJakc3Tml2bkRweTJ2WTRnaGJpbmZqL3NZYlpxZ1l1TzUydWJmSER0K1MwNzVLTUJMUjlja3lwcEZXOVRwRjdHTDhtRlgzZzFRWnVVbXRFWFdiUXVmVWFQMXg4VDQ1M1VBcjFmUGQ1TjhERHRKRkdrWExwNW83d2J0NmNyeFZEYUJkanB6OVQ1Z3VqUk1pL3ZtbWlOb1hEMjB0MS9vaEJaR3BXeTFPRTh6Z2RiZnBVaHBac0RTcTFVTEExN1AxVWFRRWZQVDFqSml0QU9zKzhkWkhNcEFQeHJ2Z0kwZmtGazVaQ2tmfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

bd9a16c0d5b97d2c466b8c235e181469534d009b8803b63a9ed0b76382ba2061

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 541614
expires: 0
access-control-allow-origin: null
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=ePPy8Xw3UnZUUFJqUHpoOUg1U0tLRjNLTzFPeWtOaHpJakc3Tml2bkRweTJ2WTRnaGJpbmZqL3NZYlpxZ1l1TzUydWJmSER0K1MwNzVLTUJMUjlja3lwcEZXOVRwRjdHTDhtRlgzZzFRWnVVbXRFWFdiUXVmVWFQMXg4VDQ1M1VBcjFmUGQ1TjhERHRKRkdrWExwNW83d2J0NmNyeFZEYUJkanB6OVQ1Z3VqUk1pL3ZtbWlOb1hEMjB0MS9vaEJaR3BXeTFPRTh6Z2RiZnBVaHBac0RTcTFVTEExN1AxVWFRRWZQVDFqSml0QU9zKzhkWkhNcEFQeHJ2Z0kwZmtGazVaQ2tmfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 269336
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET sync
ssbsync.smartadserver.com/api/ 0
0

GET
H2 200 c.gif
c.bing.com/ 42 B
691 B 331ms
171ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?Red3=STMS_pd&uid=9282484b-1526-4542-9121-a0949ea6edb5
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "e8cf83ed75a9db1:0"
x-msedge-ref: Ref A: 505D11A3FFAD4F46908D16DF52DF24CF Ref B: AKL211060117062 Ref C: 2025-04-18T05:42:16Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
last-modified: Wed, 09 Apr 2025 17:36:29 GMT
x-powered-by: ASP.NET

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=

68 B
324 B

731ms
244ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=
content-length: 323
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1294&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1294&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=1962616590014284432&gdpr=0&gdpr_consent=

68 B
323 B

243ms
243ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=1962616590014284432&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=1962616590014284432&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=themediagrid&bsw_custom_parameter=557bf20d-6e14-4855-b7ae-275a8aa9c61f
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=themediagrid&bsw_custom_parameter=557bf20d-6e14-4855-b7ae-275a8aa9c61f
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=719fd9d5-e7cd-4ce5-a1cc-5d9a0b2288b6&user_group=1&ssp=themediagrid&bsw_param=557bf20d-6e14-4855-b7ae-275a8aa9c61f

43 B
103 B

209ms
209ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=719fd9d5-e7cd-4ce5-a1cc-5d9a0b2288b6&user_group=1&ssp=themediagrid&bsw_param=557bf20d-6e14-4855-b7ae-275a8aa9c61f
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Fri, 18 Apr 2025 05:42:18 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=719fd9d5-e7cd-4ce5-a1cc-5d9a0b2288b6&user_group=1&ssp=themediagrid&bsw_param=557bf20d-6e14-4855-b7ae-275a8aa9c61f
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:18 GMT

GET
H2

200

ibs:dpid=903&dpuuid=06841cff-44c8-430f-962a-95e1e48ff5fa
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=06841cff-44c8-430f-962a-95e1e48ff5fa

42 B
718 B

74ms
73ms

Image
image/gif

13.239.76.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=06841cff-44c8-430f-962a-95e1e48ff5fa

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

13.239.76.120 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-239-76-120.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-apse2-1-v076-099c57b8b.edge-apse2.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: AAV1qhPkS94=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=06841cff-44c8-430f-962a-95e1e48ff5fa
content-length: 189
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-ae25921c-7ddb-5d95-635d-a8daefb66d95$ip$103.75.11.91&gdpr=0&gdpr_consent=

68 B
323 B

532ms
245ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-ae25921c-7ddb-5d95-635d-a8daefb66d95$ip$103.75.11.91&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Location: https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-ae25921c-7ddb-5d95-635d-a8daefb66d95$ip$103.75.11.91&gdpr=0&gdpr_consent=
Content-Length: 199
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame EECD 43 B
479 B 262ms
255ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=b00f8bb4-0754-4caa-8872-181b8f3ccd54

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 7HHRB9FGSAFPXRZ4DBH4
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2

200

v1
match.sharethrough.com/sync/ Frame EECD
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=

68 B
323 B

245ms
244ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=06841cff-44c8-430f-962a-95e1e48ff5fa&gdpr=0&gdpr_consent=
content-length: 323
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/ Frame EECD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=YjAwZjhiYjQtMDc1NC00Y2FhLTg4NzItMTgxYjhmM2NjZDU0
https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=

68 B
323 B

246ms
244ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-cache, must-revalidate
location: https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 260
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

v1
match.sharethrough.com/sync/ Frame EECD
Redirect Chain

https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=6875541723614500951

68 B
323 B

244ms
242ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=6875541723614500951

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=6875541723614500951
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 1047.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: f9b6d39b-f2d7-44a9-a3c3-68939d3484d3
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

v1
match.sharethrough.com/sync/ Frame EECD
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0013300001kQj2HAAS&ru=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DkzFyzzqXEqukMDumpVLB6Eq3%26source_user_id%3D33XUSERID33X
https://match.sharethrough.com/sync/v1?source_id=kzFyzzqXEqukMDumpVLB6Eq3&source_user_id=213075967477059

68 B
323 B

244ms
243ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=kzFyzzqXEqukMDumpVLB6Eq3&source_user_id=213075967477059

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://match.sharethrough.com/sync/v1?source_id=kzFyzzqXEqukMDumpVLB6Eq3&source_user_id=213075967477059
pragma: no-cache
referrer-policy: unsafe-url
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
server: 33XP001

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F51C 645 B
254 B 367ms
186ms Document
text/html 142.250.76.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY_vqbrAIwAQ&v=APEucNX9BTqsTk4cTt7QY4_bzBVRx1DZdTj_sOPphwpWlAJ4RPOGzRQ8SikplgYxcmuluD0CyDc6liTyLDPPLpybnXXp7k7gWEO4o03xJv8O5a09beVGhCs

Requested by

Host: 536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com
URL: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f2.1e100.net

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:42:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 010F 110 KB
37 KB 381ms
203ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com
URL: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18146946010209014275
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 05:42:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38116
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 010F 42 B
63 B 431ms
254ms Image
image/gif 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DS5rRVYJVJ78nKjnLW14zR5QjD3gK4QQ1AYu4Du4TFRkyqub4G0azjdbXLc45RuOFeGpxM7hW2ajsEx4L4fP5Sf50aE35SrtOXWBxTIpzjIBGvUFM

Requested by

Host: 536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com
URL: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250417/r20110914/client/ Frame 010F 3 KB
1 KB 604ms
171ms Script
text/javascript 2404:6800:4006:809::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250417/r20110914/client/window_focus_fy2021.js

Requested by

Host: 536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com
URL: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:809::2001 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ba1a463f7811ae10ea114a0bcc044c05c391ec1fcb3dd5a7bd9d9bb3fe2b070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14574132110251334613
age: 2408
x-content-type-options: nosniff
expires: Fri, 02 May 2025 05:02:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 05:02:09 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1242
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250417/r20110914/client/ Frame 010F 19 KB
8 KB 585ms
153ms Script
text/javascript 2404:6800:4006:809::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250417/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com
URL: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:809::2001 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95c36928f545cd166b6cb1ef4ad1487c7cca599163ce3c07137c51b206585d95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 2911858081013649353
age: 17932
x-content-type-options: nosniff
expires: Fri, 02 May 2025 00:43:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 00:43:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7948
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 010F 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 010F 221 KB
68 KB 257ms
83ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com
URL: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18003062906086184080
age: 2359
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 06:02:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 05:02:57 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69570
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame B344 43 B
479 B 393ms
255ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=xc7_riit7UinzmtSLMpz

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: A1YJB1880T2DW9J9Q4NV
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame B344 170 B
232 B 186ms
186ms Image
image/png 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_hm=eGM3X3JpaXQ3VWluem10U0xNcHo=

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame B344
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESECMUTx0kIO_pjWGlVkwFK_g&google_cver=1

43 B
717 B

862ms
243ms

Image
image/gif

13.215.145.61
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESECMUTx0kIO_pjWGlVkwFK_g&google_cver=1
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 13.215.145.61 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-215-145-61.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESECMUTx0kIO_pjWGlVkwFK_g&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 299
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame B344
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=xc7_riit7UinzmtSLMpz
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3107&partner_device_id=xc7_riit7UinzmtSLMpz
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=1bf1d573-12ef-4861-b907-370d1515bcfc%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=06841cff-44c8-430f-962a-95e1e48ff5fa&ttd_puid=1bf1d573-12ef-4861-b907-370d1515bcfc%2C%2C

95 B
124 B

220ms
219ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=06841cff-44c8-430f-962a-95e1e48ff5fa&ttd_puid=1bf1d573-12ef-4861-b907-370d1515bcfc%2C%2C

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=06841cff-44c8-430f-962a-95e1e48ff5fa&ttd_puid=1bf1d573-12ef-4861-b907-370d1515bcfc%2C%2C
content-length: 359
date: Fri, 18 Apr 2025 05:42:17 GMT
server: Kestrel

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame B344
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=-1&gdpr_consent=&piggybackCookie=1962616590014284432
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=5cfd8917b0f60a3d&is_secure=true&networkId=17100&version=1&nuid=E54DADAC-091C-44D7-B251-70AEC9DC0924&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAC03Mqh--XHQIxSTj7AQEBAQEBAQCXRmpTXwEBAQEBAQEB&expiration=1745041337&nuid=E54DADAC-091C-44...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
238 B

155ms
154ms

Image
text/plain

67.199.150.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 67.199.150.82 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

date: Fri, 18 Apr 2025 05:42:18 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:18 GMT
server: nginx

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame B344
Redirect Chain

https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?extinit=0&userid=$UID&pn_id=an
https://ads.yieldmo.com/v000/sync?extinit=0&userid=6875541723614500951&pn_id=an

43 B
710 B

893ms
243ms

Image
image/gif

13.215.145.61
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?extinit=0&userid=6875541723614500951&pn_id=an
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 13.215.145.61 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-215-145-61.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

Redirect headers

cache-control: no-store, no-cache, private
location: https://ads.yieldmo.com/v000/sync?extinit=0&userid=6875541723614500951&pn_id=an
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7ae99645-8abe-4bdf-bf9b-03eeb34e8793
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 5145 43 KB
0 70ms
70ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 97aad7b249a02fec12a538941cf194e76fb2c0955cdf070385ffc54d0d65cb39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=14497
content-encoding: gzip
expires: Fri, 18 Apr 2025 09:43:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Fri, 18 Apr 2025 05:42:15 GMT
last-modified: Thu, 17 Apr 2025 09:43:45 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2

200

xuid
eb2.3lift.com/ Frame 7ACF
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=06841cff-44c8-430f-962a-95e1e48ff5fa&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

154ms
154ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=06841cff-44c8-430f-962a-95e1e48ff5fa&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=06841cff-44c8-430f-962a-95e1e48ff5fa&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 7ACF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEPLqwsXC021FqHvRIadLntY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
476 B

156ms
155ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEPLqwsXC021FqHvRIadLntY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEPLqwsXC021FqHvRIadLntY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7ACF
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDA2NzY3MjY1OTM4NDY2MzU2Mjc4NA%3D%3D

170 B
188 B

181ms
181ms

Image
image/png

142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDA2NzY3MjY1OTM4NDY2MzU2Mjc4NA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-0-66-37.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDA2NzY3MjY1OTM4NDY2MzU2Mjc4NA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 05:42:16 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 7ACF
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDA2NzY3MjY1OTM4NDY2MzU2Mjc4NA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

154ms
154ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 7ACF 0
631 B 355ms
235ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4067672659384663562784&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E5F79161E7C94E179EC07B2C243FCA23 Ref B: AKL211060117052 Ref C: 2025-04-18T05:42:16Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzBvsqrpF05Q9BMBFadQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT

GET
H/1.1 200
OK 88342
i.liadm.com/s/ Frame 7ACF 0
208 B 890ms
255ms Image
text/plain 52.0.66.37
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=4067672659384663562784

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.66.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:17 GMT
trace-id: 015b531390111e70
Request-Time: 0
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 7ACF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/4067672659384663562784?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-VByXaUNE2oSleBdONHhxGQFt76JaHFxaioKKA7NP6w--~A&dongle=0883

37 B
476 B

155ms
155ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-VByXaUNE2oSleBdONHhxGQFt76JaHFxaioKKA7NP6w--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-VByXaUNE2oSleBdONHhxGQFt76JaHFxaioKKA7NP6w--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 7ACF 42 B
690 B 285ms
172ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=4067672659384663562784&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "e8cf83ed75a9db1:0"
x-msedge-ref: Ref A: 87B725F42B234D439D97DCAF5DDAA4CB Ref B: AKL211060117052 Ref C: 2025-04-18T05:42:16Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
last-modified: Wed, 09 Apr 2025 17:36:29 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 7ACF
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=52dfebe5ba690aa3&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAC3-Bnyx4CYwI7im09AQEBAQEBAQCXRmpRlQEBAQEBAQEB&expiration=1745041337&is_secure=true&gdpr_consent=&gdpr=0

37 B
476 B

156ms
155ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAC3-Bnyx4CYwI7im09AQEBAQEBAQCXRmpRlQEBAQEBAQEB&expiration=1745041337&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAC3-Bnyx4CYwI7im09AQEBAQEBAQCXRmpRlQEBAQEBAQEB&expiration=1745041337&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 7ACF
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-ae25921c-7ddb-5d95-635d-a8daefb66d95$ip$103.75.11.91&dongle=4430

37 B
476 B

157ms
157ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-ae25921c-7ddb-5d95-635d-a8daefb66d95$ip$103.75.11.91&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-ae25921c-7ddb-5d95-635d-a8daefb66d95$ip$103.75.11.91&dongle=4430
Content-Length: 138
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

POST
H3 204 AGSKWxVoO4Fa2q0Rl-Nl_2m0WNURDltsG1BF67D2r3QLAebaeL7uw6LSuuu4zt4Lv-BgXWflIA8pg49CkAiDaGkmz0h7EUgxoLQiINd35_NuFlhigquNLenlAnbjlQImbuZ-PSQY6gbGvA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 190ms
188ms XHR
text/html 172.217.167.110
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVoO4Fa2q0Rl-Nl_2m0WNURDltsG1BF67D2r3QLAebaeL7uw6LSuuu4zt4Lv-BgXWflIA8pg49CkAiDaGkmz0h7EUgxoLQiINd35_NuFlhigquNLenlAnbjlQImbuZ-PSQY6gbGvA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-HcqLBz3EyoeRckz3qixwWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1JBi-FB_mfUHEAvxcOw4036ATeDH_1V9zEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAAgDwk2w"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-HcqLBz3EyoeRckz3qixwWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 cm Show response
u.openx.net/w/1.0/ Frame 2F7C 684 B
704 B 166ms
166ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 207e8d5baaf31ee01e981bdec882d13f1dbd4ebe5003179ed3ba97bbfc712b0c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 684
content-type: text/html
date: Fri, 18 Apr 2025 05:42:16 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.75.11.91

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 167ms
158ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 18 Apr 2025 05:42:15 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 209894
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3567
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8772821074336499311&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

166ms
165ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8772821074336499311&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8772821074336499311&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Fri, 18 Apr 2025 05:42:16 GMT

GET
H/1.1 200
OK send
sync-dsp.ad-m.asia/dsp/api/sync/ Frame 3567 43 B
243 B 843ms
179ms Image
image/gif 220.150.223.50
BEKKOAME BEKKOAME...

General

Check archive.org

Download Go to Show image

Full URL: https://sync-dsp.ad-m.asia/dsp/api/sync/send?s=openx
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 220.150.223.50 , Japan, ASN4686 (BEKKOAME BEKKOAME INTERNET INC., JP),
Reverse DNS: 50.223.150.220.in-addr.arpa
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: close
expires: -1
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: image/gif
Server: nginx

GET
H3

200

dds
rtb.openx.net/sync/ Frame 3567
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=i4ubsM6kzuoA0HmBuMcfuQ==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

170ms
169ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET openx
cs.nex8.net/cs/ Frame 3567 0
0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3567
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/c01a77c8-f78e-e58d-d773-23c39489e84a?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-pmkp31VE2p.5lfMuQj8FTMeYk_wCIU6WNB0-~A

43 B
61 B

167ms
166ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-pmkp31VE2p.5lfMuQj8FTMeYk_wCIU6WNB0-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-pmkp31VE2p.5lfMuQj8FTMeYk_wCIU6WNB0-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
server: ATS
x-frame-options: DENY

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3567
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=268
https://us-u.openx.net/w/1.0/sd?id=537082476&val=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=

43 B
61 B

171ms
171ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537082476&val=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537082476&val=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=
Content-Length: 131
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame FAFE 19 KB
7 KB 119ms
43ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde&linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744954934762&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 9321d683aceed9ae-AKL
access-control-allow-origin: *
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame C6B5 0
920 B 150ms
148ms Script
text/html 103.43.90.54
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.54 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 103.75.11.91; 103.75.11.91; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 155c18b0-a2e6-4cf8-9910-78b0ecff7f64
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame FAFE 4 KB
1 KB 195ms
190ms XHR
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde&linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744954934762&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f0b416427a2e9f3d4d06f97220878ba833210660f920cd36c041c5a4045619c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde&linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744954934762&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9321d6834d9b1c50-AKL
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 8985 7 B
1 KB 595ms
242ms XHR
application/json 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: dedf7fc216a5bbc739a54325e875a79f
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
292 B 337ms
337ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

d02150e8e38332654349ec7561c20c4f8b89d35cc27f3824b3a44e3a77f5476b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame EB89 16 KB
6 KB 718ms
432ms Document
text/html 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

43fe7cc6db1c3739aeb83e2496de0dd49feaf3aeee148bbb99f2aabd682f9347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:42:16 GMT
server: Kestrel
server-processing-duration-in-ticks: 290767
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 200 setuid
prebid.intergient.com/ Frame 2F7C 0
867 B 269ms
269ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=6d039e43-debd-442d-8d28-f523ea85e78e
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744954937&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Uko9jswK9pr9zQuzvb1UslBGee3JB9fbWhxlXovLja0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744954937&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Uko9jswK9pr9zQuzvb1UslBGee3JB9fbWhxlXovLja0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9321d683fe98d9a8-AKL
server: cloudflare

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2F7C
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3295036552570422895&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

168ms
168ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3295036552570422895&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3295036552570422895&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Fri, 18 Apr 2025 05:42:16 GMT

GET
H/1.1 200
OK send
sync-dsp.ad-m.asia/dsp/api/sync/ Frame 2F7C 43 B
243 B 1221ms
172ms Image
image/gif 220.150.223.50
BEKKOAME BEKKOAME...

General

Check archive.org

Download Go to Show image

Full URL: https://sync-dsp.ad-m.asia/dsp/api/sync/send?s=openx
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 220.150.223.50 , Japan, ASN4686 (BEKKOAME BEKKOAME INTERNET INC., JP),
Reverse DNS: 50.223.150.220.in-addr.arpa
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: close
expires: -1
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:18 GMT
Content-Type: image/gif
Server: nginx

GET
H3

200

dds
rtb.openx.net/sync/ Frame 2F7C
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=i4ubsM6kzuoA0HmBuMcfuQ==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

168ms
168ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET openx
cs.nex8.net/cs/ Frame 2F7C 0
0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2F7C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/c01a77c8-f78e-e58d-d773-23c39489e84a?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-pmkp31VE2p.5lfMuQj8FTMeYk_wCIU6WNB0-~A

43 B
61 B

180ms
171ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-pmkp31VE2p.5lfMuQj8FTMeYk_wCIU6WNB0-~A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-pmkp31VE2p.5lfMuQj8FTMeYk_wCIU6WNB0-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
server: ATS
x-frame-options: DENY

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2F7C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=268
https://us-u.openx.net/w/1.0/sd?id=537082476&val=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=

43 B
61 B

170ms
168ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537082476&val=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.75.11.91
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 05:42:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537082476&val=riWSHH3bXZVjXaja77ZtlWdLC1s&gdpr=&gdpr_consent=
Content-Length: 131
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F51C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1&gdpr=0

43 B
766 B

166ms
163ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY_vqbrAIwAQ&v=APEucNX9BTqsTk4cTt7QY4_bzBVRx1DZdTj_sOPphwpWlAJ4RPOGzRQ8SikplgYxcmuluD0CyDc6liTyLDPPLpybnXXp7k7gWEO4o03xJv8O5a09beVGhCs
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OSYxKfxi%2BVqgSczKRiAj0aEtkh9knFVuzYLn%2FF8rMCBdKJRYbdEuNYafpns5mN8D%2Bj%2FfnW%2BqM1J9sCXwpgBe3COwCsIb1jTcZAsGqeG6a84oJCAs4Dc0bMyBbSoSa7JWVGQu%2FV2AejUwNg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9321d6853e80d99f-AKL
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 324
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F51C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAHmN4sFVewAMcb2AJVc0gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1

43 B
766 B

167ms
167ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY_vqbrAIwAQ&v=APEucNX9BTqsTk4cTt7QY4_bzBVRx1DZdTj_sOPphwpWlAJ4RPOGzRQ8SikplgYxcmuluD0CyDc6liTyLDPPLpybnXXp7k7gWEO4o03xJv8O5a09beVGhCs
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FaOju%2FC3PJuwVYhfgua66zdmcZ%2F0CKpIUOECcAPo3g%2Baf3j%2FUwd8X%2FogScnKeQAIp92VYCBgG9hfdkeO9V0z0317%2F5fanlqvkAKk0zxvkTdOdPyTiwyFNm7gb2hBE2vVPV6PCgoxa8Q4xg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9321d6863895d99f-AKL
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGm-56gctnakIOMtedIgJgM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

setuid
ib.adnxs.com/ Frame F51C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEMIDV8a83Bk5vHb3yEKhr0A&google_cver=1

43 B
1 KB

152ms
152ms

Image
image/gif

103.43.90.54
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEMIDV8a83Bk5vHb3yEKhr0A&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY_vqbrAIwAQ&v=APEucNX9BTqsTk4cTt7QY4_bzBVRx1DZdTj_sOPphwpWlAJ4RPOGzRQ8SikplgYxcmuluD0CyDc6liTyLDPPLpybnXXp7k7gWEO4o03xJv8O5a09beVGhCs

Protocol

Server

103.43.90.54 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 103.75.11.91; 103.75.11.91; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 400c7766-ae0c-4526-a0ec-420f6a970e61
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEMIDV8a83Bk5vHb3yEKhr0A&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 301
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F51C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NTU0MTcyMzYxNDUwMDk1MQ%3D%3D

170 B
188 B

180ms
179ms

Image
image/png

142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NTU0MTcyMzYxNDUwMDk1MQ%3D%3D

Requested by

Protocol

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NTU0MTcyMzYxNDUwMDk1MQ%3D%3D
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 134b42a0-c8d4-4f4d-a6a9-56f6111bd0e0
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 204 rum Show response
elb.the-ozone-project.com/cdn-cgi/ Frame FAFE 0
189 B 41ms
39ms XHR
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://elb.the-ozone-project.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=2bdee551-cd0e-49f2-a410-355720fa4bde&linkedin.com=f9ca9ccd-efa9-4202-af25-7d3d5632b729&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744954934762&bidder=ozone

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 9321d6841e581c50-AKL
access-control-allow-origin: https://elb.the-ozone-project.com
date: Fri, 18 Apr 2025 05:42:16 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 010F 0
20 B 215ms
215ms Ping
image/gif 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=917248513573&version=m202504010101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 010F 0
20 B 217ms
217ms Ping
image/gif 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=917248513573&version=m202504010101&ct=77&x=1&cor=2287094978560026600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 010F 37 KB
21 KB 242ms
242ms Script
text/javascript 142.250.76.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DJeb0MyLJ5zoNQgVA2q3vcHPtFLlZEmkX51AZBs-zuBrgCN7ajtN-xzfOVc7pJ2KF0gSvfv1331hoGAAjRWCmzZMzU4yPqSY6Wl02yddTfE9sF0cSnn73W9TJDv4uf2nSbsjBLOwjZH6KqEhLWuxoSO-Snc5oqJ_LnrNAG-u4Xm6Yj0wKN2jo8PNp5FiigjMZSeZ6i2kAK0m00m20Rj6hdHsteQdaO5zezlswk2syO_1EXmaYlochjexEwB4Xmog2JlGVueK41VRvutu-Y3a6UgzIrsZUTmZHPhcdUmpVtkjLrD8Q&cry=1&dbm_d=AKAmf-CPPPH3-4svVVKgRC7HEiofqT9GeFMh26ZXWgeebXOcRJVRyzNw06AYoe4gb_3u1IDW75WUi1pNjYsPPOE9AaNaNKrDi7VijxML-fmaPriXSiMb_ZSg4vMvT5w_RaUtN6Slo_k6657jG1ccZtejjHKYHZv8jpGgC-1ImosSAdVhgEZH5HeJ8HcWcuaHw-VVxoCCI35DIpUvOyuhzVXfb--2pEXazs4igtxCLu294ugPiT-bgEbJgw9gM55gHo3Iu0wz8OdPCydO1DIsIZsjs3y6HhE70WCN36qFW7WFdwYJHXEh5rVjqEcSz8FNZe3WSe-aIwkoAhXliC94G_6VhPmlfj3jVoW7D-xHH_oPd7a0vLsAjM00_3P2l759zsDmw3sAROMAl-rHZqRIAuud4-3rMHDvdRjOKwrwQRE1vO8zpPVZGAsfd1JxJ1YrocnOJlW2XIZM3M9TyG1A9bFWrH8IcQJOQqCvofohW2GZ6hJr3iI9rJVwm9bIZywrS4E4XoZY4LHnuYDlOUnC-Rdo7jCnVq5TJoYAKTCIWuv_rC2yFhD5ASjRnaSxbJwKA3eQrmkusm2w_J43PAy0TkXLleF3aZgn5P1l2VZYZ3JlngwD01zquuKo9twoAH3ICPt9-Auj8ZJS6d85KkCfeavY8SxyisR905sOidefqRFML2l0C56TDPBHlhXCwBeRGbSF6N_r4GCwLB57W5Yk4lf58-hTSKYe8R3I42dQExLjTttDqYvmeRMS7jr7JGLKaYJE2FNb5KpBVAjSUvMTiFPBUyWaTFKZ5COOiRiLFhaLgnYD5i8P31Na1O-AEtoxHydusm-ze8dpCnLg6-FgjVCOV6k4qJ8Ppa91VV0Q7OgD8GMTBLN0V3_Z78xGK2kOPuGSbT_divpAKLs9IH0GRGHvMQOS-jZNX4Zv4BWmpuYeBG0ZZ53Y1PsT0AgWs1s86A9daX42nxBjFAP06FjtJ449KLU7G6itpSafSmb8oLeMGfH_xrULKN0yeIm5F9BCaBTgDZprDTqUOw2kvTGBYudFkgu3XHINCFrfRbHCGyLCQRNOj8klvxsv5uViOib3Ox5qTmfnq07F8F_ppcJlZzc9lZDxJB-a_LpZ8JlgwEyNMt-tFrIkzF5XeMD3kCYAhjb-LhjA23vMw2peRFB5hwSFhxYTfaLb2cqlnZKBda8eQXN5CFeV82Ec0C4SEMauEZi4efeUdw3q9MokuEKKOeY1qhaPRZqhIRXgJunEWX0NkfqysRNKNrTB1iU9tSXQz2tiy1Dm8RjWc8fMoIs39lxLRpxAr3Pl-TsPqh1qMerKJZojH2Hc0IDtud76nVIAj9k9mwjs_D0MN8lhelC0eVUYKouyNYpx9fjbJZoLFaJLG5dH4B4NyCpmMjsrBe1jfdG4GzYM9LEy4NkJeZgWr0o3UuZtA2aZHy5NbqJSTRaKgE4k0qFQh3LL7hpC0zf76ZONn0MJNA2Ae5uOmo69kR1alN-XXOMfIwsagM2tFwPcRhrJ4A1G6jukCgW2pxzFsHOt04QIRllbPTCXSJxBDFCU4iP2a8Nyw48QMqlyM083j8b_c_60_yS6ENPZZHEKfpRbKJqaoleCM6o9WuQV597nsO9m7D5Po1x7Pz5maJ-ohl0_NCj_pnxoOz9YL10ScdRQ6HtmWx0AeIB6nvzNA5Pdsm9CDleIpXDEn8Trh4oc_x9fR-HQb6LmcrRoPRNfJMz3qkzZ2CYOvObq6yiVP8GtgBkOP2nhJ7D8nLnuFs_9qx6HisycODD-xdNbu2yFX3iD3XmyFhhUmzx_z41l8QOA6XrHJD82Vpip-4u2yABxQLKIX4P972kUuEvheFnsinRh0FH0jHe-RUXYqDiraEiztTwfHbfskZaLHm6x7rYaZ63EiodG1eQ2_a0sWNimLZcPBNMTpGM-Nx2I_HlIXRiV1j6U4yhqBnd5EB6rg_SrbcH93xWoiDzejhphKTu3sVrms-kHQ8RVxpMrIKKhIOvMx-wwoTn0hehCg2Px_dr6YzohDis8HvocwHuRP3G2TwSupHAovXGAb1JtxndT57byxREQMD-sV_nCvaQabNSu1upJXSMJJdzNcTb_Nln9UWFRU7d3TArjRCr4cGS3tZd565WNtb--H1RpvragwQREbXvRZqW9TAb73LyjJY2yI9UOoB6_WeXNny2T5gIfcktmAE31oBf5j9FLCQ84mBikqxAt9mC5QNxdHSqEnKyz7SqFLDWjGUqopC5N41aRXVkwYzkl8_V83uBl3MW-DcebFU_Vvar1hWet4b4iqOhCoCDIjpw4VSk6oLWW4_RFAfJkAjwN1JgUe43yaIOlD8ZAfeDZj9rd6ZfNYAAwCRyCxH1XyaRkSVGS_h2bqPjAt8HLmTQUZusrFHz4up7UMvnZlEwVKFbp8jRGmVBURJ9youWS1RYEWWZWaR7G3_hWEmUI_ytWosKe5Za99NGx4fo6uWaBfJzQR72V3HRUP5hqAuqgfFzaG2s14luQCxf_f3qBx_3w5Yn68ytUaaqgO6TscFuRgS5JjxRp30PX6cuwRyVOdALKuMP-zlEtjd0mJ2OvH5jcyWJ_LSsupqCMecpX9jkpzoxYzCaG7IQj_6OkWeaGOf-rgvBAsZ0sz073LTwKShYRG3R_CF4V9e3SHNpVnYWBQyRVDfFr9NFT46Tgp41SobmIorHT0YHs4gc9IYZ_7N_s7hv7Z1kYKv8vRvn0yjzC8gwvNb9DfLui270D-EHHnoV3_E0zYdGypuBFz7Tg12Ms_-FeHyFtltNll_XiMRWMNzw4QCOdTCIdkW_KnQeQRFEiFhUTFM7aOMhhh8AdCo-4ChVWKgN30S6TYDqYAxW7tP-zyaPlnYtUGoxR_4vDd35xn2-slKP2H1h2SCN6V9t6f2NEfthSX3Mc0JZmisMdH651oWBPKuaaatKY-nEePTGAlqn_5EFoX_Z3eLDcmG4nXwCvxca_CnZssR0KCOWl1tdErQthM7rseY2YJ6jdnx8Vefy9ubG2xR52UvtS9cnCwVuHsSRZrQUlo8pN-nxlf2TqELMfpDY3R__vo2xyMmlZgM1qyX88-qqu2sY8W8XvC_zaShBbeNEhDt__Pkz82baYabwoRbvSvQYsSLq4LN6jbVu_GQEJQslHbYqujC57DaKYOolSR_AJvEy2Q5k_UWMbjocXEx_FYcsRnNAF4OuRo4itKF8BZ1zZZRuwMQhCbryMoKvsGkG9a5WL-CQHnumkAjnKvF8m1efXSADvE53YLa0HGINwJz7zNPrn0iy7ZhINAf-dj6CbJO-hzdiTu1mnogtMc9aM0IaKB9z0YDA2xcrq6_XS17Vqo39yN8PBgzGaYa2DSkqBZWmjle_ad2JQuUp24h-cLSqfVY2FCz-aGXbqfttXlupxkPOsQ0LpPtAyY30W7WTs5tW9YS1IhOCfQ2x0vfQjHSirJCyL7S6Zshbd3o0mKO2LLZHD4DVPVMAy9s2sj02FJOvj6ny9pUPtA1njWHSsVqnkcBFhfKrqx1UCVD2rC3QlcfX6gJQ_P59IfTqFx9dVCtyQwEg6chXD6G7zuRynU4NGmMqU83pb6RJMiQdn8KVVBvKPq8sk1p2MmRc3VOQAIvDTZ6IllokEpdytI1xsCo6NoJg8NhtVMKPbaEMNV8Q-TMG9wUdIoGnrgjoUCbeyZ_EGWvL4pmjAawSrNxyL5LygPRaMShrXL0-2_teE7ELhLQ_kFr3zGgGbzhCbEap0Y0ZGO5Bnshsj_C1JhTcjLNJmCRjf4lOld6tqDJEsk3N2x-U-GhefZz63Dyqro9SFANUivQi26uk6-O508As6EuSwQAmZ2OXFDYJ-5icnTb75BcJIzYnXVGAEbXAWr6-9iZv1tmdP-MHqynAX4jKu1q5fwNmqCz8-s3W8JT-DB9ELV7Q5_Rk84xwoA4OXQcTMpJstrfd69Jvym7rBLJ7pElGHQV_RmbO0nATTvbmjPFW8imDy0vNdqjIQmdI9NeBa9gHlx57ogo8rqaEJIHMNrpHcKwmkWc6YpR17IMQvdLvOLdZcqfdC4h_O81aFVXiC1s15oqj-NW0qwgKoxwBOZllrAedMs2lqdjHew9tzb9_N542TT-VrsdxOPDEQJNmMFfVlptVOqdNm0vN5eLA2GJ7s5cX-Zj-T4gJZeCB3iWUbnsv6BKVQqOiLm0JQrIROAaqy86MUm7Jb4GKhktXCnlIxHFNagLLwT5B9V8F3TcTNX_GApNZCGJbiiHjYKewJR-KeK3JnIqOYynuDlxU1a9Qb59N-rl7HbWiLvN_p6fIk83YVB5Y-BigU73Dt1Ox9E5ImYRFG9QEFYq23BonzFgyUNLqokEP6VsfEM2-jeK6m-fpU8CzfrB2tG9EP-8L54c6eYLXRi2UI2_6r3CERtWzVEoxo3pO6ftl6TngM-HmRGwgTGgVTkalgeAFQc3qlQO9JEshCh7UD24Cd1PdtHC6gO3Y3i3_a3QZSrgdaAndBcb6pVRMhv0vyx1HMmT7Ue31_J8oZiUarHmRsSJ6oyHP1bPG7Q8OaLZr5rT8COEXsZ3arMVd8TBZDMrrXIPE9YXU08w5Khqr9KcQm7ldrwubvnlT52AISfQEv-Cuzn--CRdBRL-FK43yhqhF6fXemen5OHefHLcHd71nZepR7W5flbw_Eknmtath3vjhIJrZO7qIlePXazG6-FX-I8xeahItYLaaRyiJ0u4w&cid=CAQSPADZpuyzk24OgTzepr1OEQo-6_dj6iomEhz2pkMxP72OA2WS99NtzLKyyxp-ao8NWVIT4qRYkdmAYok8cxgB&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=77&iif=1&cor=2287094978560026600&adk=3037181501&idt=433&cac=0&dtd=37

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f2.1e100.net

Software

cafe /

Resource Hash

b2827acc80ddb4c2924e632a6a31d419d4ab62d2364d2e60ca7ba50c607ede1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://536387e8b0cf9d9ed506e6891730d5c1.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 21413
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame FAFE
Redirect Chain

https://ads.yieldmo.com/pbsync?is=ozone&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirectUri=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dyieldmo%26gdpr%3D0%26gdpr_consent%3D%26us_p...
https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xc7_riit7UinzmtSLMpz&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone

0
686 B

196ms
196ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xc7_riit7UinzmtSLMpz&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 9321d6886a271c50-AKL
expires: 0
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

location: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xc7_riit7UinzmtSLMpz&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 779D 43 B
479 B 258ms
257ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09

Requested by

Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 40HS680PWD8WSNXG2G4B
Content-Length: 43
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1 200
OK setuid
ow.pubmatic.com/ Frame 779D 86 B
460 B 491ms
152ms Image
image/png 67.199.150.77
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=inmobi&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.77 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

Date: Fri, 18 Apr 2025 05:44:03 GMT
Content-Type: image/png
Content-Length: 86

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 779D 170 B
188 B 183ms
181ms Image
image/png 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=RkDBmCd2sP2A57a2DzR3&gdpr_consent=&gdpr=&google_nid=inmobi_dbm

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 779D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_cm
https://sync.inmobi.com/gob?google_gid=CAESELHTrwFQoItNdF3GsGysTqk&google_cver=1
https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=&retry=
https://cm.g.doubleclick.net/pixel?google_hm=RkDBmCd2sP2A57a2DzR3&google_push=&google_nid=inmobi_new_eb

170 B
188 B

181ms
180ms

Image
image/png

142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=RkDBmCd2sP2A57a2DzR3&google_push=&google_nid=inmobi_new_eb

Requested by

Protocol

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_hm=RkDBmCd2sP2A57a2DzR3&google_push=&google_nid=inmobi_new_eb
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=157097&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D157097%26mpc%3D4%26fp%3D1%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252...
https://image4.pubmatic.com/AdServer/SPug?fp=1&mpc=4&p=157097&pmc=1&pr=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D76%26dspUserId%3DE54DADAC-091C-44D7-B251-70AEC9DC0924
https://sync.inmobi.com/setuid?bidderID=76&dspUserId=E54DADAC-091C-44D7-B251-70AEC9DC0924

0
18 B

269ms
269ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=76&dspUserId=E54DADAC-091C-44D7-B251-70AEC9DC0924
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

cache-control: no-store, no-cache, private
location: https://sync.inmobi.com/setuid?bidderID=76&dspUserId=E54DADAC-091C-44D7-B251-70AEC9DC0924
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 05:42:17 GMT
server: nginx

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=g6nxmp9&ttd_tpi=1&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=21&dspUserId=06841cff-44c8-430f-962a-95e1e48ff5fa

0
18 B

270ms
269ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=21&dspUserId=06841cff-44c8-430f-962a-95e1e48ff5fa
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

location: https://sync.inmobi.com/setuid?bidderID=21&dspUserId=06841cff-44c8-430f-962a-95e1e48ff5fa
content-length: 209
date: Fri, 18 Apr 2025 05:42:17 GMT
server: Kestrel

GET user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 779D 0
0

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://sync.e-volution.ai/a184e2218ea9f18e32c70fb304405e72.gif?puid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D957%26dspUserId%3D%5BUID%5D...
https://sync.inmobi.com/setuid?bidderID=957&dspUserId=163f1fa2-6d42-472e-98a8-4f9d576e7501

0
18 B

272ms
271ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=957&dspUserId=163f1fa2-6d42-472e-98a8-4f9d576e7501
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://sync.inmobi.com/setuid?bidderID=957&dspUserId=163f1fa2-6d42-472e-98a8-4f9d576e7501
Pragma: no-cache
Connection: keep-alive
Expires: 0
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:17 GMT
Server: nginx

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://ib.adnxs.com/getuid?https://sync.inmobi.com/setuid?bidderID=32&dspUserId=$UID
https://sync.inmobi.com/setuid?bidderID=32&dspUserId=6875541723614500951

0
18 B

271ms
271ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=32&dspUserId=6875541723614500951
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

cache-control: no-store, no-cache, private
location: https://sync.inmobi.com/setuid?bidderID=32&dspUserId=6875541723614500951
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.75.11.91; 103.75.11.91; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 8e0ad4b4-2817-496c-8d06-66bb8b7ddd79
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 05:42:17 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://b1sync.zemanta.com/usersync/inmobi/?puid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=&gdpr_consent=&us_...
https://b1sync.outbrain.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=&gdpr_consent=&puid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&s=...
https://b1sync.zemanta.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=&gdpr_consent=&obuid=bacf2483-a00e-4aa2-8099-2f5dc66f7421&puid=ID5...
https://sync.inmobi.com/setuid?bidderID=210&dspUserId=bacf2483-a00e-4aa2-8099-2f5dc66f7421

0
18 B

274ms
273ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=210&dspUserId=bacf2483-a00e-4aa2-8099-2f5dc66f7421
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=210&dspUserId=bacf2483-a00e-4aa2-8099-2f5dc66f7421
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 117
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: text/html; charset=utf-8

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://inmobi-match.dotomi.com/match/bounce/current?networkId=98193&version=1&nuid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09
https://inmobi-match.dotomi.com/match/bounce/current?DotomiTest=51290f15d80b0ac2&is_secure=true&networkId=98193&version=1&nuid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09
https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQACxm-9jV4xCgIID0BNAQEBAQEBAQCXRmpQHwEBAQEBAQEB&expiration=1745041337&nuid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&is_secure=true

0
20 B

274ms
273ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQACxm-9jV4xCgIID0BNAQEBAQEBAQCXRmpQHwEBAQEBAQEB&expiration=1745041337&nuid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&is_secure=true
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 4
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQACxm-9jV4xCgIID0BNAQEBAQEBAQCXRmpQHwEBAQEBAQEB&expiration=1745041337&nuid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&is_secure=true
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
pragma: no-cache
server: nginx

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3535&partner_device_id=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&partner_url=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D877%26dspUserI...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=1bf1d573-12ef-4861-b907-370d1515bcfc%252Chttps%25253A%25252F%25252Fsync.inmobi.com%25252Fsetuid%25253FbidderID%25253D877%...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=06841cff-44c8-430f-962a-95e1e48ff5fa&ttd_puid=1bf1d573-12ef-4861-b907-370d1515bcfc%2Chttps%253A%252F%252Fsync.inmobi.com%...
https://sync.inmobi.com/setuid?bidderID=877&dspUserId=1bf1d573-12ef-4861-b907-370d1515bcfc

0
21 B

272ms
272ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=877&dspUserId=1bf1d573-12ef-4861-b907-370d1515bcfc
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
x-envoy-upstream-service-time: 2
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

strict-transport-security: max-age=31536000
location: https://sync.inmobi.com/setuid?bidderID=877&dspUserId=1bf1d573-12ef-4861-b907-370d1515bcfc
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
server: Jetty(11.0.25)

GET
H2 200 sync
x.bidswitch.net/ Frame 779D 43 B
103 B 214ms
204ms Image
image/gif 35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=aerserv&user_id=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&gdpr=&gdpr_pd=&gdpr_consent=&us_privacy=&expires=30
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif

GET
H2 200 159
match.deepintent.com/usersync/ Frame 779D 0
39 B 236ms
226ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Download Go to Show image

Full URL: https://match.deepintent.com/usersync/159
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

date: Fri, 18 Apr 2025 05:42:17 GMT
server: c
content-length: 0

GET
H2

500

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://id.rlcdn.com/713074.gif?
https://sync.inmobi.com/setuid?bidderID=97&dspUserId=

60 B
60 B

270ms
270ms

Image
image/avif

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: a6642f816880217435423f2ae3bc4af4cdfb0ef852c20563e304eff8b79f025a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 60
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 0
content-type: image/avif;charset=UTF-8
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT

GET usync.html
eus.rubiconproject.com/ Frame 779D 0
0

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 779D
Redirect Chain

https://s.ad.smaato.net/c/?dspInit=1001980&dspCookie=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&gdpr=&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=5ccd96df6a&gdpr=0&gdpr_consent=

43 B
855 B

259ms
258ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=5ccd96df6a&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: R4E4MH182K548XJH4346
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 18 Apr 2025 05:42:17 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=5ccd96df6a&gdpr=0&gdpr_consent=
content-length: 5
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: text/plain; charset=utf-8

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=inmobi&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=82&dspUserId=56d04a3846

0
18 B

272ms
272ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=82&dspUserId=56d04a3846
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=82&dspUserId=56d04a3846
content-length: 5
date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: text/plain; charset=utf-8

GET
H/1.1 400
Bad Request user-sync
sync.adkernel.com/ Frame 779D 22 B
22 B 475ms
158ms Image
text/plain 103.67.201.72
PHOENIXNAP-AS-SG1...

General

Check archive.org

Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?zone=147857&t=image&gdpr=&gdpr_consent=&r=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1029%26dspUserId%3D%7BUID%7D
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 103.67.201.72 , United States, ASN59210 (PHOENIXNAP-AS-SG1 PhoenixNAP, SG),
Reverse DNS: 1.cpm.sin1.wowcon.net
Software: nginx /
Resource Hash: 4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

Cache-Control: no-store
Content-Length: 22
Date: Fri, 18 Apr 2025 05:42:17 GMT
Server: nginx
Connection: close

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://cs.playdigo.com/dd3f91b3168664e47ebd1aec9512abd4.gif?puid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1302%26dspUserId%3D%5BUID%5D&g...
https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=38f596ff-9ebc-4ad9-ab55-3ae6a5d96487

0
18 B

272ms
271ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=38f596ff-9ebc-4ad9-ab55-3ae6a5d96487
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=38f596ff-9ebc-4ad9-ab55-3ae6a5d96487
Pragma: no-cache
Connection: keep-alive
Expires: 0
Keep-Alive: timeout=5
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:17 GMT

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D13%26dspUserId%3D%24UID
https://sync.inmobi.com/setuid?bidderID=13&dspUserId=Kg-WALZHOmIutDO_QxeutXy1

0
18 B

275ms
274ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=13&dspUserId=Kg-WALZHOmIutDO_QxeutXy1
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

location: https://sync.inmobi.com/setuid?bidderID=13&dspUserId=Kg-WALZHOmIutDO_QxeutXy1
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://cs.krushmedia.com/4831fbf13dd518a56346a6e0ec8ba9d5.gif?puid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1315%26dspUserId%3D%5BUID%5D...
https://sync.inmobi.com/setuid?bidderID=1315&dspUserId=6236fc1f-0bfd-5171-931f-cfbc8b08ee91

0
18 B

274ms
273ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=1315&dspUserId=6236fc1f-0bfd-5171-931f-cfbc8b08ee91
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

expires: 0
cache-control: no-cache, no-store, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=1315&dspUserId=6236fc1f-0bfd-5171-931f-cfbc8b08ee91
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
pragma: no-cache
server: nginx

GET
H2 200 sync
ittpx.eskimi.com/ Frame 779D 43 B
175 B 981ms
323ms Image
image/gif 188.40.16.220
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to Show image

Full URL: https://ittpx.eskimi.com/sync?sp_id=64&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.40.16.220 , Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.220.16.40.188.clients.your-server.de
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

date: Fri, 18 Apr 2025 05:42:17 GMT
content-type: image/gif
x-empty-response-reason: Disabled country (nz: 103.75.11.91)

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://creativecdn.com/cm-notify?pi=inmobi&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=16&dspUserId=s9HESh1bTvxZNQqyHHJKvM9C4geM3LSCBd-StgdA0oQ&pi=inmobi&gdpr=&gdpr_consent=

0
18 B

269ms
269ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=16&dspUserId=s9HESh1bTvxZNQqyHHJKvM9C4geM3LSCBd-StgdA0oQ&pi=inmobi&gdpr=&gdpr_consent=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:16 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://sync.inmobi.com/setuid?bidderID=16&dspUserId=s9HESh1bTvxZNQqyHHJKvM9C4geM3LSCBd-StgdA0oQ&pi=inmobi&gdpr=&gdpr_consent=
content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT, Fri, 18 Apr 2025 05:42:17 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://cs.admanmedia.com/e03deca3316b700a1ce99c41e324fd03.gif?puid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D149%26dspUserId%3D%5BUID%5D&...
https://sync.inmobi.com/setuid?bidderID=149&dspUserId=d00b8bed-cb73-4a0e-a46c-8f153b3f4380

0
18 B

270ms
269ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=149&dspUserId=d00b8bed-cb73-4a0e-a46c-8f153b3f4380
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

expires: 0
cache-control: no-cache, no-store, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=149&dspUserId=d00b8bed-cb73-4a0e-a46c-8f153b3f4380
content-length: 0
date: Fri, 18 Apr 2025 05:42:18 GMT
pragma: no-cache
server: nginx

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://tracker-shr.ortb.net/sync?id=1&uid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09
https://sync.inmobi.com/setuid?bidderID=276&dspUserId=c7db0e24-d6e5-b855-fdef-c683ad306195

0
18 B

271ms
270ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=276&dspUserId=c7db0e24-d6e5-b855-fdef-c683ad306195
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

access-control-max-age: 3600
location: https://sync.inmobi.com/setuid?bidderID=276&dspUserId=c7db0e24-d6e5-b855-fdef-c683ad306195
access-control-allow-credentials: true
access-control-allow-methods: GET, DELETE, OPTIONS, POST, PUT, PATCH
permissions-policy: browsing-topics=()
access-control-allow-origin: *
content-length: 106
content-type: text/plain; charset=utf-8
access-control-allow-headers: *

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://sync.clearnview.com/redirect?gdpr=&gdpr_consent=&usp_consent=&pubid=17&pubuid=ID5-1-435c7f7c-7f6c-4860-bc13-8ceedd302e09&redirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D869%26d...
https://sync.inmobi.com/setuid?bidderID=869&dspUserId=fe978372-55b3-5938-b14b-a81a8ff9a5a5

0
18 B

270ms
270ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=869&dspUserId=fe978372-55b3-5938-b14b-a81a8ff9a5a5
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:18 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

Transfer-Encoding: chunked
Location: https://sync.inmobi.com/setuid?bidderID=869&dspUserId=fe978372-55b3-5938-b14b-a81a8ff9a5a5
Keep-Alive: timeout=5
Date: Fri, 18 Apr 2025 05:42:18 GMT
Connection: keep-alive

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://us.ck-ie.com/inmslw82.gif?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3DID5-893%26dspUserId%3D%7B%24PARTNER_UID%7D
https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=c1b97c5430f727433f997d14dcbc033a98c7426e6869ead7621bb37dca0a99e1

0
41 B

269ms
269ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=c1b97c5430f727433f997d14dcbc033a98c7426e6869ead7621bb37dca0a99e1
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:18 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

Transfer-Encoding: chunked
Cache-Control: no-cache, no-store, must-revalidate
Location: https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=c1b97c5430f727433f997d14dcbc033a98c7426e6869ead7621bb37dca0a99e1
Pragma: no-cache
Connection: keep-alive
Expires: 0
Date: Fri, 18 Apr 2025 05:42:18 GMT
Server: nginx

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://csync.loopme.me/?pubid=9724&gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D109%26dspUserId%3D%7Bviewer_token%7D
https://sync.inmobi.com/setuid?bidderID=109&dspUserId=3b1e216c-50e8-48d3-b7f9-51fd39bdc3cf&gdpr_consent=null&gdpr=null

0
41 B

271ms
270ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=109&dspUserId=3b1e216c-50e8-48d3-b7f9-51fd39bdc3cf&gdpr_consent=null&gdpr=null
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:19 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

location: https://sync.inmobi.com/setuid?bidderID=109&dspUserId=3b1e216c-50e8-48d3-b7f9-51fd39bdc3cf&gdpr_consent=null&gdpr=null
content-length: 0
date: Fri, 18 Apr 2025 05:42:18 GMT
server: _

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=138&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=238&dspUserId=riWSHH3bXZVjXaja77ZtlWdLC1s

0
20 B

284ms
284ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=238&dspUserId=riWSHH3bXZVjXaja77ZtlWdLC1s
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 6
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

Location: https://sync.inmobi.com/setuid?bidderID=238&dspUserId=riWSHH3bXZVjXaja77ZtlWdLC1s
Content-Length: 108
Date: Fri, 18 Apr 2025 05:42:18 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 204 inmobi
tr.blismedia.com/v1/api/sync/ Frame 779D 0
171 B 337ms
167ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/inmobi?gdpr_consent=&gdpr=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
date: Fri, 18 Apr 2025 05:42:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://sync.1rx.io/usersync2/inmobi&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5096666364
https://sync.1rx.io/usersync/tradedesk/06841cff-44c8-430f-962a-95e1e48ff5fa
https://sync.targeting.unrulymedia.com/csync/RX-8958192e-e5ed-4d36-a611-019135af8b63-004?redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D23%26dspUserId%3DRX-8958192e-e5ed-4d36-a611-019135...
https://sync.inmobi.com/setuid?bidderID=23&dspUserId=RX-8958192e-e5ed-4d36-a611-019135af8b63-004

0
18 B

271ms
270ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=23&dspUserId=RX-8958192e-e5ed-4d36-a611-019135af8b63-004
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

location: https://sync.inmobi.com/setuid?bidderID=23&dspUserId=RX-8958192e-e5ed-4d36-a611-019135af8b63-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Fri, 18 Apr 2025 05:42:17 GMT
etag: RX8958192ee5ed4d36a611019135af8b63004
content-type: text/html

GET
H2

200

setuid
sync.inmobi.com/ Frame 779D
Redirect Chain

https://match.prod.bidr.io/cookie-sync/inm
https://sync.inmobi.com/setuid?bidderID=12&dspUserId=AAEH6U7QA8wAAB5KLqIXTg

0
18 B

270ms
269ms

Image
text/plain

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=12&dspUserId=AAEH6U7QA8wAAB5KLqIXTg
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 05:42:17 GMT
x-envoy-upstream-service-time: 1
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://sync.inmobi.com/setuid?bidderID=12&dspUserId=AAEH6U7QA8wAAB5KLqIXTg
Content-Length: 0
Date: Fri, 18 Apr 2025 05:42:18 GMT
Server: gunicorn
Connection: keep-alive

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 340ms
339ms XHR
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS