paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRZ09GTWFrRFNvS1Rrd1FUOHI5cUotMjYxOS0yNjcyMjgwOC0wZmY3MDI3Ni0zNjg0LUlRUkY2WUx2Q1pIM2E1cmM5eXps/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 9054
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Fri, 18 Apr 2025 07:41:30 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JS3XGXKS0HSY0YHKDKDXE4DX

Redirect headers

accept-ranges: bytes
age: 4040
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Fri, 18 Apr 2025 07:41:30 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JS3XGXH7PNZ8GE14PVH0S05C

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 307ms
129ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fac9b40286601a5b0082707b8a4938060215cffdeb5300f769941156fda46e94

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 9322852bf9c02b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 80ms
79ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 8534
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JS3XGXPKE7HRRM6V11NCJ4X5
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 82ms
81ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 9054
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JS3XGXPK3B6M999WE6DNE955
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 81ms
81ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 25724
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JS3XGXPKE43NHS6JQV0CYBRP
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 148ms
147ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 18173
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JS3XGXPKZZ9WDBA3WG3N9VMW
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 81ms
79ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 18173
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JS3XGXS9EPMHY5G85TTE9D54
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 83ms
82ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 8535
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JS3XGXS9Z68VX2NDNBE5F61V
cache-status: "Netlify Edge"; hit
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 197ms
105ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd7d0f77ed93389d609b6c5b62d8b20832f887a462871194223feeebafd3a055

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9322852bf9c42b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
123 KB 488ms
189ms Script
application/javascript 2607:f8b0:4006:823::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2082e25408d0d813cbfebec352d19aa3cee2cee18d404a697eccaa910fe52f2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Fri, 18 Apr 2025 07:41:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 125370
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 41dc2f87ded629d7d50d348fec190978d7d6754a055119da.v2.js Show response
faucetfoot.com/public/js/ 68 KB
25 KB 306ms
138ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/public/js/41dc2f87ded629d7d50d348fec190978d7d6754a055119da.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

e5058e6eb9f4ff46dd957177ead156d251ba27b91806af4530fdd785b394a579

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"6f9b4c89b1dfc37a44e4b3735bcc5c47b504370d1f6b3bbaeb6ddc48ed642156"
via: fen-hoothoot-us-west1-spot-079b.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
33 KB 476ms
162ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ed22a8b82a26a67cfe3b96b7323848a0cadf10f804529d73a12eb8f1da2c57a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 773 / 20196 / 31091857 / config-hash: 9604267607936975774
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 07:41:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34026
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 95ms
94ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 3586
cf-ray: 9322852cda932b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 411 B
386 B 82ms
82ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b35367386570f17ff5be2b4d3f5a9ef2816b7947869005cfae73ec88dcba460

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"038af8099c70ce8099f11e60671651ea"
age: 2721
cf-ray: 9322852cda992b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.f78d8905f1617efa83f4.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 114ms
113ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aed279b0a29e774ca22dafc6a078e7582490608c9d18bda1a138ca55d0d5be9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f1a6e4325cdcf59d711cbdc9bbf9de8f"
age: 4884
cf-ray: 9322852d6b252b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.f49d9d120d738f961843.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 461 KB
140 KB 157ms
157ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad7d0d55c693f50a025e443da2f37eaea32dad37cbfe918cde1717f8f33af733

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"2da544a46407e9f6f4d2fc5d5058f814"
age: 4886
cf-ray: 9322852d6b282b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
479 B 459ms
149ms Image
image/gif 2600:9000:247b:9a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?ab=1&zoneid=6724608_advertisement_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:9a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 2753
x-cache: Hit from cloudfront
x-amz-cf-id: 75Iu_nSfCctY9bB76OOjqm_V3jwxNjUIOV--rlO3Gf3_ohuYIvFm_A==
date: Fri, 18 Apr 2025 06:55:39 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 1dbafa627b28576f280c85d24d02a0c2.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 559 B
444 B 87ms
87ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 2085
cf-ray: 932285305dfe2b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame A1C7 503 B
427 B 308ms
91ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 4883
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93228531ea182af1-LAX
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 07:41:31 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame B537 503 B
0 307ms
306ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 4883
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93228531ea182af1-LAX
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 07:41:31 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/3/desktop/Chrome/ 583 B
919 B 583ms
148ms XHR
application/json 2600:9000:24f1:7e00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/3/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:7e00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 72a4730886d557ad0df1b2d396bb68c3b659c0d67da7da6ce56359526bec2602

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 1899
via: 1.1 cd958e502c6aea704f0f824e60431e72.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 583
x-amz-cf-id: QULDn-mQM_I4uDD1hqaX-nle0IZlkCHeRm7yAGUZToRi7hvlzEzXIA==
date: Fri, 18 Apr 2025 07:09:53 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 149 KB
39 KB 238ms
81ms Script
application/javascript 2606:4700:10::6816:4bd8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4bd8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db3b4c65b9b7c658c43074b51473188ca8efe46a669c6801234e3267be15168a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "c270076359905b3d723a15d71336e6a6"
via: 1.1 google
cf-ray: 93228531ad56cb86-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39507
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: application/javascript
last-modified: Fri, 18 Apr 2025 07:06:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.12d39b3042a89bfe935d.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 85ms
83ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/ccpa.12d39b3042a89bfe935d.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 109c88771b4dd248e3dca670efe895b5aaefb0ee49e1cca776b2640717a933ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"206627f4662eb69e99a3cb421866652c"
age: 4884
cf-ray: 93228530be382b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 357 KB
86 KB 616ms
184ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8d079b3855248fcdd0eb891569d2c669c4df9d09e81270f254e37280b51e274a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"8eb33601d7a1e0448ae3ae6845bc11ff"
age: 2501
via: 1.1 1c6074d72abc2b2cd13356e16b77c834.cloudfront.net (CloudFront), 1.1 2301ef513d768666e30ce282b9045098.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: LXG1BhMNhkwjWmFHba9YyHPPxBDP83bwUzuonbQXaDFUpL5XDUP7bw==
date: Fri, 18 Apr 2025 06:59:52 GMT
content-type: application/javascript
last-modified: Tue, 15 Apr 2025 20:03:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
592 B 675ms
217ms Image
image/gif 2606:50c0:8002::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 699779eea1bdd9e6e53dc10990715c1ed4844f4b
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: A8FF:7A21E:1027F3F:122A9DF:67ECEDD1
expires: Fri, 18 Apr 2025 07:46:32 GMT
x-cache: HIT
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: image/gif
x-served-by: cache-toj-leto2350039-TOJ
x-cache-hits: 3
source-age: 138
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1744962092.163364,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/ 532 KB
167 KB 136ms
136ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a820a02d18d73004524cbf8d4170826ba5ac35b430263742cc579d57125b72cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 575157741531990292
age: 78017
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 10:01:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 10:01:14 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170595
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/ 64 KB
23 KB 145ms
143ms Other
text/plain 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

e4a1f6bb4df43a4e3aded46465e55b8749b64817d13ed9557075c596d218c340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5790688912801242087
age: 63625
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 14:01:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 14:01:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23384
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504170101"

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 504ms
163ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 3436
via: 1.1 e23983892b1c8fb4d47f943c0ee29028.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: bGgjDq04CNSCTs6uD-40GPxg4P1fMMsGbdRYLabWD95MZnWvdEDy6w==
date: Fri, 18 Apr 2025 07:02:20 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 314 KB
109 KB 180ms
179ms Script
application/javascript 2607:f8b0:4006:823::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1b77860b2c78099288ae1d4221ee010c3b6a6dec88094dbe968be43bbc3bd5c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Fri, 18 Apr 2025 07:41:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 111614
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 633ms
333ms Fetch
text/plain 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54g3v9101576445za200&_p=1744962090688&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=511358154.1744962092&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744962091&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2217
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:820::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 init-a.js
dl.edge-aicdn.net/assets/ 0
0 550ms
89ms Fetch
text/javascript 172.67.74.15
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://dl.edge-aicdn.net/assets/init-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 849559
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZSp7NO4QS9f9Cacu%2FGUEdixkMYQDb5fdH1OMtgtGrEAfs7v1PAvWOU0UChdRxQIilCdbtceQhVQkWjYzREXcYxN4ZBi94PvNriunWgNJ%2BOIRF1vifJuMYLid9pzqCwx6DE2d"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 08 Apr 2025 12:41:18 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=69268&min_rtt=69102&rtt_var=14793&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3796&recv_bytes=2203&delivery_rate=56519&cwnd=252&unsent_bytes=0&cid=0382ea1dc3dc934e&ts=95&x=0"
x-goog-stored-content-length: 0
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:38:53 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItesXpewPkh3PVY937gliQHvMmcijA3GPuaT77G9JBAsbvjNCh5I27xQNwCrR3XBlJF
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 932285354fcf2f4f-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743183533533707
content-length: 0
server: cloudflare

GET
H2 200 config-a.js
storage.ml-cachehost.net/lib/ 0
0 328ms
108ms Fetch
text/javascript 2606:4700:20::681a:1f4
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://storage.ml-cachehost.net/lib/config-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:1f4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 523209
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9aNEpxr5bH4Y2mWXZl%2BEZexYczfX%2FkJiEgvPYF%2BAD4BfN91iUIM%2B88wiDyKI2gRzNUPwQZDjrZzaDruB9dDa9G80p6rZUlRf91SXOKxJ845yrlF17i0PMYLaTx63gb5CajzzZ%2Fgn9p0IBx8NAfRZm%2BYqimAJJg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Sat, 12 Apr 2025 06:51:19 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=91395&min_rtt=90947&rtt_var=19971&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3830&recv_bytes=2247&delivery_rate=41816&cwnd=251&unsent_bytes=0&cid=6cc15a178c3b7bc3&ts=115&x=0"
x-goog-stored-content-length: 0
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:51:11 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIs4sN3hJIqt_b1oTFGgd_PbZD_XaRCaRDAX0wAr0U_XABLtxFfBYUYmx5pPcSKRqzi_
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 93228533cb117bb3-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743184271495855
content-length: 0
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 272ms
80ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 36508
x-goog-stored-content-encoding: identity
expires: Thu, 17 Apr 2025 22:00:40 GMT
x-goog-stored-content-length: 43
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIuVhxtzH5or1NaAN1FQPkbYjHVlN3TVh11t-R3BSk4F7q4OO6PrFuo_Y9PzMs1Y8IUEPF-z0K0
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 93228533992bcbab-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 365ms
158ms Image
image/x-icon 142.250.81.230
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 13734
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 19 Apr 2025 03:52:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 03:52:38 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
627 B 270ms
79ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.14388015080831096
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 36508
x-goog-stored-content-encoding: identity
expires: Thu, 17 Apr 2025 22:00:40 GMT
x-goog-stored-content-length: 43
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIuVhxtzH5or1NaAN1FQPkbYjHVlN3TVh11t-R3BSk4F7q4OO6PrFuo_Y9PzMs1Y8IUEPF-z0K0
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 93228533992fcbab-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame A1C7 17 KB
7 KB 106ms
105ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4884
cf-ray: 932285329ac52af1-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame B537 17 KB
0 93ms
93ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4884
cf-ray: 932285329ac52af1-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:31 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

POST
H3 200 2f9fdaebdd99f71aaf1c26ec879999a33cdfd09213aae9f4ff1f2097f1709758fc Show response
faucetfoot.com/submit/ 295 B
319 B 248ms
140ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/submit/2f9fdaebdd99f71aaf1c26ec879999a33cdfd09213aae9f4ff1f2097f1709758fc

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/public/js/41dc2f87ded629d7d50d348fec190978d7d6754a055119da.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

0a7ea363c51957a346acabb1b595cb0001fb5528deaccacc376b6c1b37b9b3cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-spot-079b.gce-us-west1, 1.1 google
expires: Fri, 18 Apr 2025 07:41:31 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 285ms
284ms Fetch
text/plain 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54g3v9102396898za200zb9101576445&_p=1744962090688&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=511358154.1744962092&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1744962092&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1744962090688&tfd=2653
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54g3v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:820::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 201 KB
65 KB 565ms
219ms Script
application/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5415552713154cc7b854550162fcb56ce0fd9be750131cfbe8b4498de25de92b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8v0tVdiSSNrBQomuqfaorQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmJw1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4uFY09JxgE2go2nRFSYljaT8wvjk_LySosyk0pL8orTktNTi1KKy1KJ4IwMjUwMTQzM9A8P4AgMAZrkzJg"
content-security-policy: script-src 'report-sample' 'nonce-8v0tVdiSSNrBQomuqfaorQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET 92fc32d6-c081-4660-aa8b-3a85ebd4ee4f
https://paint.toys/ 0
0

GET
H2 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 258ms
93ms XHR
application/json 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 18173
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744943919&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=E2%2B0j3WtqutLvVpK0DcktoBrn0%2BmSRM9LD1kp%2By08q0%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Fri, 18 Apr 2025 02:38:39 GMT
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744943919&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=E2%2B0j3WtqutLvVpK0DcktoBrn0%2BmSRM9LD1kp%2By08q0%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 932285376815d938-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
1 KB 87ms
84ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 6934
cf-ray: 932285369c1e2b58-LAX
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:08 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 441ms
133ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRZ09GTWFrRFNvS1Rrd1FUOHI5cUotMjYxOS0yNjcyMjgwOC0wZmY3MDI3Ni0zNjg0LUlRUkY2WUx2Q1pIM2E1cmM5eXps/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 80900c7d27627dc76b3cd2bd98442b1f55956be28d6c486b28890cb05455eb93

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 446 KB
141 KB 472ms
181ms Script
text/javascript 2607:f8b0:4006:824::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd157b223b1750cc055c61f89e92980c4bf01073ceca11ae087780f86eb5ff63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16482565349839558474
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 07:41:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144243
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
658 B 2053ms
444ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-44-209-74-43.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
778 B 440ms
142ms Fetch
application/json 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: 8cb3889894d991c123ec7375a7e04855d6e4e5e017f2ccc1576bad12a0fc0995

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
683 B 657ms
323ms Fetch
application/javascript 34.232.220.61
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.220.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-220-61.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 885b8ea76912e4caa7c3a903d9ca5c3f8f9fc662e7a0717cbe1d4ad49e855b4f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 262ms
94ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7c8be61d2eb3b9a103e32595ebd2d69314d5bf2e581ddf8e6b65f0cc5087cdf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
538 B 430ms
142ms Fetch
text/plain 44.209.74.43
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js3xgzgv0vv4xywespxbts4q&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.209.74.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

7eb8832471bb97c3ede3bb2c4014f0de59567ff0c92158258790f2c2eb5daf7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 91a983774d2aae63
request-time: 8
access-control-allow-credentials: true
expires: Sat, 19 Apr 2025 07:41:32 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=oAnOFHx6dVN6eW9HR09OT3pLSE11OGhUZkdKamRNTW5SekpJbU5ETndNZzdCbG5UV3F5aHYwOGZOcDBFMGx2TDRCNlRIYmMwdGZYdHE5dDdHVG1oN3Uyc3BzUjY2ZFBLKzd4bTRYMGlvY0JPRTQ5WXhpNXRGQWw3dHJGY2...

357 B
930 B

382ms
127ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=oAnOFHx6dVN6eW9HR09OT3pLSE11OGhUZkdKamRNTW5SekpJbU5ETndNZzdCbG5UV3F5aHYwOGZOcDBFMGx2TDRCNlRIYmMwdGZYdHE5dDdHVG1oN3Uyc3BzUjY2ZFBLKzd4bTRYMGlvY0JPRTQ5WXhpNXRGQWw3dHJGY2szVndQZ09PbFRORjlCY3EzOEVJRVFDTW9HaWVJZ1JqNXd4Q0NGYWZGeUp5K1hCTFVDaDRBdE9URWo4Qm1XdUIzZ01XS2l5MmZZZ1lTNkVkR200RW0vTnVaZExLWVozcDc2WTErTFZCUk5uYzYxWlpIc3F2QVJySU9qeTdwQWttZ3U2ZmVLbE9YfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4bde1921e71663ea7cd1dfa4895130392df68f01f00e6e8951050ff1ed9df1db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 617874
expires: 0
access-control-allow-origin: null
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=oAnOFHx6dVN6eW9HR09OT3pLSE11OGhUZkdKamRNTW5SekpJbU5ETndNZzdCbG5UV3F5aHYwOGZOcDBFMGx2TDRCNlRIYmMwdGZYdHE5dDdHVG1oN3Uyc3BzUjY2ZFBLKzd4bTRYMGlvY0JPRTQ5WXhpNXRGQWw3dHJGY2szVndQZ09PbFRORjlCY3EzOEVJRVFDTW9HaWVJZ1JqNXd4Q0NGYWZGeUp5K1hCTFVDaDRBdE9URWo4Qm1XdUIzZ01XS2l5MmZZZ1lTNkVkR200RW0vTnVaZExLWVozcDc2WTErTFZCUk5uYzYxWlpIc3F2QVJySU9qeTdwQWttZ3U2ZmVLbE9YfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 260558
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Fri, 18 Apr 2025 07:41:33 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_da75f6c0-9b32-4ca0-ad03-2f45e7f0db48_1744962092508
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfZGE3NWY2YzAtOWIzMi00Y2EwLWFkMDMtMmY0NWU3ZjBkYjQ4XzE3NDQ5NjIwOTI1MDgQABoNCKyEiMAGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=69c60a6ac594b5bae58594caf783583edf5b49a85907002f10d1aed0539dcd2c791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=69c60a6ac594b5bae58594caf783583edf5b49a85907002f10d1aed0539dcd2c791426b5417dce21&rand=02080776
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=69c60a6ac594b5bae58594caf783583edf5b49a85907002f10d1aed0539dcd2c791426b5417dce21&rand=02080776&expected_cookie=b36e251d-c63a-4fb5-a485-53605eb28cfb

0
360 B

122ms
121ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=69c60a6ac594b5bae58594caf783583edf5b49a85907002f10d1aed0539dcd2c791426b5417dce21&rand=02080776&expected_cookie=b36e251d-c63a-4fb5-a485-53605eb28cfb
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 422C3E8BAE5D4F2CA1EDD4EB4AEC20A1 Ref B: LAX311000115017 Ref C: 2025-04-18T07:41:33Z
x-li-fabric: prod-ltx1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYzCKW+hqlxiPJj6uAPWA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Apr 2025 07:41:32 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: /db_sync?pid=10339&puuid=69c60a6ac594b5bae58594caf783583edf5b49a85907002f10d1aed0539dcd2c791426b5417dce21&rand=02080776&expected_cookie=b36e251d-c63a-4fb5-a485-53605eb28cfb
x-msedge-ref: Ref A: 65F2389A02624087995581358161B931 Ref B: LAX311000115017 Ref C: 2025-04-18T07:41:33Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYzCKW8bxZLH/6yZw90Ow==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Apr 2025 07:41:32 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_da75f6c0-9b32-4ca0-ad03-2f45e7f0db48_1744962092508
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_da75f6c0-9b32-4ca0-ad03-2f45e7f0db48_1744962092508

1 KB
2 KB

135ms
135ms

Script
application/javascript

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_da75f6c0-9b32-4ca0-ad03-2f45e7f0db48_1744962092508
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: 835ea4d2d76a306f6a063d366613a7ed6c6349c3126b241b00a5f45e95bd8086

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 07:41:33 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_da75f6c0-9b32-4ca0-ad03-2f45e7f0db48_1744962092508
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 07:41:33 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 397ms
125ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 18 Apr 2025 07:41:32 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 176320
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 409ms
136ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 27700
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: Ekfm4j50oOsnEf3TLEiTKj58msbu-J8DwLg67bRoonxHNcNQN8tG1A==
date: Thu, 17 Apr 2025 23:59:53 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 bce50d2cc476ede482a8048a0c124908.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
831 B 474ms
179ms Script
application/javascript 108.138.106.108
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-108.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 2103
via: 1.1 16fbe6f2baa3fcc1563be742e6d45f20.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: P-96Xy6YuGo7jX-n40KtFAM5FTT0K7kSI_xHXy3R94IBi20JzGH4Kw==
date: Fri, 18 Apr 2025 07:06:30 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 150ms
146ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 16248
access-control-allow-credentials: true
via: 1.1 2301ef513d768666e30ce282b9045098.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: TKyoijQoTVV6jhjz4mEFT3rW7M1g7j-_IoqAdVG4k6cPhLwS6oyDGQ==
date: Fri, 18 Apr 2025 03:10:43 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
375 B 574ms
217ms Fetch
application/json 13.225.61.3
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&pid=RDIIQA5FlwlUQ&cb=0&ws=1600x1200&v=25.409.1848&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=d33de3d6-9b9b-4c14-b95c-d9a4793d7b54&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.61.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-61-3.ewr53.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 92f8ba2eac28a12283a77bc938ff1728.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: AgmxgkZ6CHisXCl-82FnEJEzY0O4XmKL9aWLY_ASJkAv1HbQU_3JMA==
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: EWR53-C1
server: Server

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
444 B 478ms
177ms XHR
application/json 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: 49b290dd6935c305fd11a796cc4d24258a57cf2adb5ad79719b463c86fe27c0f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=utf-8

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame D397 1 KB
2 KB 294ms
70ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 3088
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 06:50:04 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AKDAyIvPazgfi5IsB7MmNpwqh_HNBgBZ3kZCRZt9lWektYBZfA-Wu1NGNZ5Ia8pB717H4b1EHBCa3Q

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame F867 2 KB
1 KB 419ms
133ms Document
text/html 23.41.168.202
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.202 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-202.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=167476
content-encoding: gzip
content-length: 859
content-type: text/html
date: Fri, 18 Apr 2025 07:41:33 GMT
expires: Sun, 20 Apr 2025 06:12:49 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 295ms
178ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a18931a1714808c7938f6dc5f25faff7f75d924220cace84e84b1fe7476f3012

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744962092&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ZwbhgPmXx5IRE%2FGb%2B9LNauL%2FTD29xD9EIHgFA8fzvB0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744962092&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ZwbhgPmXx5IRE%2FGb%2B9LNauL%2FTD29xD9EIHgFA8fzvB0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 932285386a7869b2-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 422 B
1 KB 1373ms
1256ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ceddb97650bdfd7651db43c723c99212fa547bb973a04df70abff3005b3250f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744962092&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ZwbhgPmXx5IRE%2FGb%2B9LNauL%2FTD29xD9EIHgFA8fzvB0%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744962092&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ZwbhgPmXx5IRE%2FGb%2B9LNauL%2FTD29xD9EIHgFA8fzvB0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 932285386a7769b2-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 449ms
136ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=39002629056&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:32 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
659 B 250ms
101ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 176f4647a7a39e367c28d4bfade338065449405873963a078adf85bb6e832798

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nAVzRxCSQoHOnKo5D0CNA11S7FxGnmgCyGUMr5zrpAzuJueAwBG0UPDt1N5mTCsilVUgFmbFuoqL7%2BwfuGmsWIi8R4AeKVT6OELCFzl57IUljx4hqD7GR1cWv3Na9bnUW31c1Upx"}],"group":"cf-nel","max_age":604800}
cf-ray: 93228538a84f0ff5-LAX
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 37
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 144 B
993 B 373ms
194ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 062a1fab8443c9fc7c1547c6e7efabfcf0beb28324f1932f97d7c506a3342853

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93228538da623a6b-LAX
expires: 0
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 251ms
97ms Fetch
text/plain 35.186.253.211
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 131cb543cc958b926221fbac502cdc5d45b61f0ece50a7baeb447d4bd63711c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.244
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/plain
vary: Origin

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
706 B 1080ms
242ms Fetch
application/json 103.43.90.178
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.178 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 3e16582d-731e-4923-8b03-3dfc51bfba85
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 07:41:33 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 470ms
140ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 25 B
312 B 526ms
169ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2afa13d15ae958dd2e685c24db5742fe9cb3958097d565c28046da3eb2a3bf42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
853 B 430ms
136ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-222-148-106.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-auction-status: 29, 29, 29, 29
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 424ms
132ms Fetch
application/json 18.208.84.35
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744962092747&to=600&aun=pw-160x600_atf&pubcid=30f428aa-650e-47d3-8a1d-dcedb29b0c03&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=226b7fbe-134e-4757-8302-a2750f28df79&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=8653&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.208.84.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-84-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 424ms
132ms Fetch
application/json 18.208.84.35
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744962092748&to=600&aun=pw-160x600_btf&pubcid=30f428aa-650e-47d3-8a1d-dcedb29b0c03&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=6be1ea83-178a-4b63-b04e-c25d32104d55&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=8653&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.208.84.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-84-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 426ms
135ms Fetch
application/json 18.208.84.35
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744962092748&to=600&aun=leaderboard_atf&pubcid=30f428aa-650e-47d3-8a1d-dcedb29b0c03&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=b93d5b38-03b2-4675-8e2e-717c499b422b&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=8653&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.208.84.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-84-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 431ms
140ms Fetch
application/json 18.208.84.35
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1744962092748&to=600&aun=leaderboard_btf&pubcid=30f428aa-650e-47d3-8a1d-dcedb29b0c03&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=7179c324-9fb6-4642-ba8e-8a904779f6e6&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=8653&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.208.84.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-84-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
625 B 1392ms
141ms Fetch
application/json 3.168.102.47
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-47.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: f126fe3e0e121464253e4ac5c9c9835cc027c5f191f04e768165f7d120fca617

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 595266d427582990356e9f138eba5bf2.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: 3Dclp99TGomC0OJCWveyUFsxnVhd0RtKdw6ACgjNj4HuDZoNdx8AFg==
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 583ms
244ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=a5a2870d-40bf-4e70-b79d-aca54a39d90d&l_pb_bid_id=113acd4ef0a8bcc2&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=226b7fbe-134e-4757-8302-a2750f28df79&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.410475785013498
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 2c0528ee240a544942a50f3f8842bf9161ed3835ba8dda1d1e1ca27a18ce5910

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 526 B
875 B 564ms
225ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=a5a2870d-40bf-4e70-b79d-aca54a39d90d&l_pb_bid_id=114f4b917572ec0b&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=6be1ea83-178a-4b63-b04e-c25d32104d55&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.4785836734307556
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 6097ca988bb787219a147e246029bb65c5fe07e025efe86c40529a8e302987e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 526
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
881 B 549ms
210ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=a5a2870d-40bf-4e70-b79d-aca54a39d90d&l_pb_bid_id=115efc1e56f58627&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=b93d5b38-03b2-4675-8e2e-717c499b422b&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.7707768486601283
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: aad533aa3d327a915cd91599e9ccdde736f96ba2cb6eb789f52c13eef00a1ba2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
1 KB 469ms
132ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=a5a2870d-40bf-4e70-b79d-aca54a39d90d&l_pb_bid_id=116dcbf7d8f8f046&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=7179c324-9fb6-4642-ba8e-8a904779f6e6&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.6448103314173885
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: f2012631eb1f664114b307c5e0f00dcc607d2de8389be5deea2b599b42a123f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 995ms
143ms Fetch 3.81.85.18
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.85.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 996ms
145ms Fetch 3.81.85.18
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.85.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 1124ms
272ms Fetch 3.81.85.18
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.85.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 1120ms
269ms Fetch 3.81.85.18
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.85.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 605ms
290ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 07:41:33 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 979ms
372ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 07:41:33 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1127ms
284ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 07:41:33 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1138ms
268ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Fri, 18 Apr 2025 07:41:33 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 1184ms
214ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:33 GMT
server: nginx

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 997ms
136ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRZ09GTWFrRFNvS1Rrd1FUOHI5cUotMjYxOS0yNjcyMjgwOC0wZmY3MDI3Ni0zNjg0LUlRUkY2WUx2Q1pIM2E1cmM5eXps/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Fri, 18 Apr 2025 07:56:33 GMT
accept-ranges: bytes
content-length: 17407
date: Fri, 18 Apr 2025 07:41:33 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 158ms
155ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRZ09GTWFrRFNvS1Rrd1FUOHI5cUotMjYxOS0yNjcyMjgwOC0wZmY3MDI3Ni0zNjg0LUlRUkY2WUx2Q1pIM2E1cmM5eXps/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 495
via: 1.1 e23983892b1c8fb4d47f943c0ee29028.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: MSxeoDRHz4yehCagxnpYbVmOgSLdC6DJ0THdusJUG6R9bjtllTMvDA==
date: Fri, 18 Apr 2025 07:33:17 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 348ms
168ms Script
text/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRZ09GTWFrRFNvS1Rrd1FUOHI5cUotMjYxOS0yNjcyMjgwOC0wZmY3MDI3Ni0zNjg0LUlRUkY2WUx2Q1pIM2E1cmM5eXps/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 2344
cf-ray: 932285393ad3d7cc-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 356ms
172ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50e007518d200ae11214757387229dbd045c72df7a6180821e460442a605565a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: ngILwLpRi8dXyeDeVCAXeW1vBcmBrVvuKgmL0iqjzWHk7Ci6T4vyNTqL+UQHatJzlw3d6Pv4uSSyTW85wvI2pw==
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"5ad11df110aef21f5b862d37fdc34379"
age: 2093
x-amz-request-id: Y5KN3GWYER275ZA4
cf-ray: 932285393a8cf8cf-LAX
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 02 Apr 2025 08:25:26 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 1130ms
272ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRZ09GTWFrRFNvS1Rrd1FUOHI5cUotMjYxOS0yNjcyMjgwOC0wZmY3MDI3Ni0zNjg0LUlRUkY2WUx2Q1pIM2E1cmM5eXps/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Fri, 18 Apr 2025 07:56:33 GMT
accept-ranges: bytes
content-length: 5252
date: Fri, 18 Apr 2025 07:41:33 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
485 B 146ms
144ms XHR
application/json 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: 2c8f23bd81ae6ac1b7212f3550d1ec71af57a83c971ac48240907c14d2627fbc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=utf-8

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 410ms
130ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 826D
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

269 B
379 B

433ms
137ms

Document
text/html

23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Fri, 18 Apr 2025 07:41:33 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Apr 2025 07:41:33 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
server: AkamaiGHost

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1744962093089&did=did-0046&se=e30&duid=8e413bd09c43--01js3xgzgv0vv4xywespxbts4q&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgr...
https://rp4.liadm.com/j?dtstmp=1744962093089&did=did-0046&se=e30&duid=8e413bd09c43--01js3xgzgv0vv4xywespxbts4q&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcg...

13 B
369 B

474ms
131ms

Fetch
application/json

3.217.98.102
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1744962093089&did=did-0046&se=e30&duid=8e413bd09c43--01js3xgzgv0vv4xywespxbts4q&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjoz
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.217.98.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-217-98-102.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 7fa5ec6a-bb59-4bb6-9ad7-450013194d14
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1744962093089&did=did-0046&se=e30&duid=8e413bd09c43--01js3xgzgv0vv4xywespxbts4q&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjoz
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Fri, 18 Apr 2025 07:41:33 GMT

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 460ms
131ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 430ms
135ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&bid=1e2n4ou

70 B
440 B

136ms
135ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 07:41:33 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&bid=1e2n4ou
content-length: 191
date: Fri, 18 Apr 2025 07:41:33 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MnU5cTRxbGFhbU9OR0Fjb2p3OW44OFRTR0NzMDRmTF9laUZGMVBvMHJCNms&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MnU5cTRxbGFhbU9OR0Fjb2p3OW44OFRTR0NzMDRmTF9laUZGMVBvMHJCNms&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

221ms
133ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 07:41:34 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Fri, 18 Apr 2025 07:41:33 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-SD_NKg1E2pUgsdBHSOYc8iGP4ayLReUL.fA-~A&gdpr=0

70 B
440 B

221ms
134ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-SD_NKg1E2pUgsdBHSOYc8iGP4ayLReUL.fA-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 07:41:34 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-SD_NKg1E2pUgsdBHSOYc8iGP4ayLReUL.fA-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8670328399276094062&newuser=1&referrer_pid=m51mh00

70 B
440 B

246ms
134ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8670328399276094062&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 07:41:33 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8670328399276094062&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Fri, 18 Apr 2025 07:41:49 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=5713953459701352546&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

197ms
135ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5713953459701352546&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Apr 2025 07:41:34 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=5713953459701352546&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 3f80b63b-9243-43b7-9365-6fc2020c73e6
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 07:41:33 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 263ms
88ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6192d7b9a03dc98c0490251dfd8f4f7b767bfb4c2726977fc3019a6635bdf342

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 214
cross-origin-resource-policy: cross-origin
cf-ray: 9322853d6a30101c-LAX
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Fri, 18 Apr 2025 07:28:40 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
278 B 98ms
97ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54fc8ea45571face84111198da10ece068d138d297d7af72365400bff5c097b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 9322853d5dfdc523-LAX
access-control-allow-origin: *
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 318ms
89ms Preflight
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 9322853cccd9c523-LAX
content-length: 0
content-type: text/plain
date: Fri, 18 Apr 2025 07:41:33 GMT
expires: Sat, 18 Apr 2026 07:41:33 GMT
server: cloudflare

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 436ms
143ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 18 Apr 2025 07:41:33 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 156932
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 ima_ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 67 B
59 B 153ms
152ms XHR
application/json 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fpaint.toys%2Foil%2F

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

641768f2d1d19839fc3cecfa5158382fa0d332d5e49e31bcaafbedc4af91995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 07:41:33 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 35
date: Fri, 18 Apr 2025 07:41:33 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 AGSKWxU_HryeEmYtRgEfYjAvFGkFGN_8dZdsFUDF0NMH1LPJHIn_ZTAmy8rpUqKIoYVPvpB0t2QoeK6GVmbFqlyUonFbZX3JCQnUpqX985pIHWEp1TD_defCeoKruGJMAkjVPC1_nEW4NA== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 176ms
173ms Script
application/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxU_HryeEmYtRgEfYjAvFGkFGN_8dZdsFUDF0NMH1LPJHIn_ZTAmy8rpUqKIoYVPvpB0t2QoeK6GVmbFqlyUonFbZX3JCQnUpqX985pIHWEp1TD_defCeoKruGJMAkjVPC1_nEW4NA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTYyMDkzLDU4MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ6WkdTRnhoQy16SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmRtY2dyYXRoYnVpbGRpbmcuY29tIl0sWzI1LCJbWzk1MzQwMjUzLDk1MzQwMjU1XV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

86f7d2a1a453764f57fd8302a9b3f513721c8e782c29383ddd286b1f1354a732

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-SdPcXF26PxUUjVe8dF1tQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmJw1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4uFY29JxgE3gxa-rB5iUNJLyC-OT8_NKijKTSkvyi9KS01KLU4vKUovijQyMTA1MDM30DAzjCwwAk6U0Hg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-SdPcXF26PxUUjVe8dF1tQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 8B28 101 KB
28 KB 412ms
134ms Document
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af8c669f941e754271c71ba5714ac0e5247ce6c3d1b1638257e1b2862d33beaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 73
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28941
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 07:40:20 GMT
expires: Fri, 18 Apr 2025 08:30:20 GMT
last-modified: Mon, 14 Apr 2025 19:44:10 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 480ms
142ms Script
application/javascript 2600:9000:24f1:d000:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:d000:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 2285
x-cache: Hit from cloudfront
x-amz-cf-id: E2NqyIV09Dz34T5XSaTkG89MG3-AZJEi0DjzOBtOcJZvsbA4e21DFQ==
date: Fri, 18 Apr 2025 07:03:29 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 820b14719bf91dbc846cab9728bc3fe6.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 242ms
70ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 230979
x-goog-stored-content-encoding: gzip
expires: Wed, 15 Apr 2026 15:31:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 15 Apr 2025 15:31:54 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyItIUbTZ9gJzw53fy34N30mENeJLMNCCyMCkzVlwDjNzWvvg2EyjGztrDlmBBHR9QwwJ
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 398ms
235ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 78d5a239d34562eeb7cfc2ba4b3c01b8

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 256ms
85ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 478538
cf-ray: 9322853fc9d4522b-LAX
expires: Mon, 21 Apr 2025 07:41:34 GMT
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 535ms
261ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Sat, 19 Apr 2025 07:41:34 GMT
access-control-allow-origin: *
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 AGSKWxV9MJwFhrro6RuJPWMNJfPVmKdNBU03ylecwkopw6BTv3bIN-hlxBytk8ZZ6wqhahOIECc0COSb4X9eKWeYpohXHD3k8xeaH5BRMHvI9bvBpxzNZ7u0GQMVTRMBiAJ5sKlT3-5wfQ== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 173ms
172ms Script
application/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV9MJwFhrro6RuJPWMNJfPVmKdNBU03ylecwkopw6BTv3bIN-hlxBytk8ZZ6wqhahOIECc0COSb4X9eKWeYpohXHD3k8xeaH5BRMHvI9bvBpxzNZ7u0GQMVTRMBiAJ5sKlT3-5wfQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTYyMDkzLDc2NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwielpHU0Z4aEMtekkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXd4ei5kbWNncmF0aGJ1aWxkaW5nLmNvbSJdLFsyNSwiW1s5NTM0MDI1Myw5NTM0MDI1NV1dIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d936202875b1c33e3aacb1fe508fa5428475b75ba654022247d0b70c4a8b9cf8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-X-kUOlUgqSn4OXWhlLupfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tHikmJw1ZBiUAjbydR68xzrdCA2Wnue1QWIDRUusToD8f11l1ifA_GH-susP4C4SOIKawsQx6bdZE0F4t69N1lvHLnJKsTDsbal4wCbwIq_D6cxK2kk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkamBia6RkYxhcYAAAdJzT7"
content-security-policy: script-src 'report-sample' 'nonce-X-kUOlUgqSn4OXWhlLupfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 bounce Show response
id5-sync.com/ 29 B
448 B 826ms
443ms Fetch
text/plain 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/plain;charset=utf-8
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 686ms
223ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 281ms
84ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e3f84b2a779d78921849c67d98e91ee507be4fe504fc609bb4293bce0e5910e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 86
cf-ray: 93228540781b08a6-LAX
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Fri, 18 Apr 2025 07:38:38 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
95 B 332ms
128ms Image
image/gif 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&halo_id=060ixedju6a659beecie6bjh8d6bhgefgf6uomkwi0e0y6gmmium0gws4k0gsqmoq
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93228540cd8569d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 340ms
103ms Image
text/html 44.231.79.48
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.231.79.48 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-231-79-48.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&adnxs_id=5713953459701352546&gdpr=0

43 B
95 B

116ms
116ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&adnxs_id=5713953459701352546&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 932285422e9969d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&adnxs_id=5713953459701352546&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 76db7b54-904f-4e2e-ad23-6d9c1d866e52
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 07:41:34 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001744962094-R1ULF4NE-M36X%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001744962094-R1ULF4NE-M36X%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=fee0ce57-c80e-4682-aec1-a69f111e6e39&id=AU1D-0100-001744962094-R1ULF4NE-M36X&auid=AU1D-0100-001744962094-R1ULF4NE-M36X

43 B
95 B

116ms
116ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=fee0ce57-c80e-4682-aec1-a69f111e6e39&id=AU1D-0100-001744962094-R1ULF4NE-M36X&auid=AU1D-0100-001744962094-R1ULF4NE-M36X
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 932285427ed769d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=fee0ce57-c80e-4682-aec1-a69f111e6e39&id=AU1D-0100-001744962094-R1ULF4NE-M36X&auid=AU1D-0100-001744962094-R1ULF4NE-M36X
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001744962094-R1ULF4NE-M36X
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001744962094-R1ULF4NE-M36X
https://ids.ad.gt/api/v1/pbm_match?pbm=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&id=AU1D-0100-001744962094-R1ULF4NE-M36X

43 B
95 B

132ms
132ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&id=AU1D-0100-001744962094-R1ULF4NE-M36X
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93228543c81969d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&id=AU1D-0100-001744962094-R1ULF4NE-M36X
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:34 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001744962094-R1ULF4NE-M36X&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&rub=M9MHDK6C-23-KJX&gdpr=0

43 B
95 B

118ms
117ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&rub=M9MHDK6C-23-KJX&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 932285431f5a69d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&rub=M9MHDK6C-23-KJX&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: eea754ae2ea80a3b4eb2fcf35349058a
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001744962094-R1ULF4NE-M36X&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&id=AU1D-0100-001744962094-R1ULF4NE-M36X

43 B
94 B

312ms
126ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&id=AU1D-0100-001744962094-R1ULF4NE-M36X
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93228540cd8269d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&id=AU1D-0100-001744962094-R1ULF4NE-M36X
content-length: 259
date: Fri, 18 Apr 2025 07:41:33 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001744962094-R1ULF4NE-M36X&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001744962094...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001744962094-R1ULF4NE-M36X&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001744...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=5967c3cc-e428-4fa4-824b-3bd9530bd4ff%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttd_puid=5967c3cc-e428-4fa4-824b-3bd9530bd4ff%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&tapad_id=5967c3cc-e428-4fa4-824b-3bd9530bd4ff

43 B
95 B

116ms
115ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&tapad_id=5967c3cc-e428-4fa4-824b-3bd9530bd4ff
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9322854488b769d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&tapad_id=5967c3cc-e428-4fa4-824b-3bd9530bd4ff
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT
server: Jetty(11.0.25)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
243 B 155ms
150ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001744962094-R1ULF4NE-M36X

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:33 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001744962094-R1ULF4NE-M36X
https://ids.ad.gt/api/v1/amo_match?turn_id=8670328399276094062&id=AU1D-0100-001744962094-R1ULF4NE-M36X

43 B
170 B

264ms
119ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=8670328399276094062&id=AU1D-0100-001744962094-R1ULF4NE-M36X
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93228540cd8669d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=8670328399276094062&id=AU1D-0100-001744962094-R1ULF4NE-M36X
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Fri, 18 Apr 2025 07:41:30 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&uid=d30657d1-c05f-4c80-9115-cd7da89e3f8d&gdpr=0

43 B
95 B

114ms
114ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&uid=d30657d1-c05f-4c80-9115-cd7da89e3f8d&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9322854478a969d1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001744962094-R1ULF4NE-M36X&uid=d30657d1-c05f-4c80-9115-cd7da89e3f8d&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Fri, 18 Apr 2025 07:41:34 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-60
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001744962094-R1ULF4NE-M36X
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDk2MjA5NC1SMVVMRjRORS1NMzZY

170 B
188 B

154ms
154ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDk2MjA5NC1SMVVMRjRORS1NMzZY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:34 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 932285411dbb69d1-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NDk2MjA5NC1SMVVMRjRORS1NMzZY
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 826D 43 KB
11 KB 136ms
135ms Script
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: d5bac0b19c9b62dafe59ea2542333d9716a454baa9e65ce236f076f748d052fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

Response headers

cache-control: max-age=24784
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:34:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Fri, 18 Apr 2025 07:41:33 GMT
last-modified: Thu, 17 Apr 2025 14:34:37 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 135ms
135ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Fri, 18 Apr 2025 07:56:33 GMT
accept-ranges: bytes
content-length: 17042
date: Fri, 18 Apr 2025 07:41:33 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 7CDC
Redirect Chain

https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gd...
https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx...

943 B
1 KB

100ms
98ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: d1f036a1559ae12220cf28f1a5b369f0eacfbef504858caf3671854fda722dca

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 943
content-type: text/html
date: Fri, 18 Apr 2025 07:41:33 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 18 Apr 2025 07:41:34 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 452ms
142ms XHR
application/json 2606:ae80:1471:16::820
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:16::820 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Fri, 18 Apr 2025 08:11:34 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json
vary: Origin
server: nginx

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
4 KB 502ms
501ms Fetch
text/plain 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1762930085030358&correlator=3875243397704062&eid=31091857%2C83321073%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504170101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1744962094169&lmt=1744962094&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDMwZjQyOGFhLTY1MGUtNDdkMy04YTFkLWRjZWRiMjliMGMwM1gBEh0KDmVzcC5jcml0ZW8uY29tGJeE4r7kMkgAUgIIZBIYCgl5YWhvby5jb20Y_YfivuQySABSAghvEhQKBW9wZW54GJyH4r7kMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Yl4TivuQySABSAghkEhcKCHJ0YmhvdXNlGJeE4r7kMkgAUgIIZBKHAQoObGl2ZWludGVudC5jb20SczEzLW5YU21VVk01SmNVMkhyV2RDKyswRFh6SnIvNkJ3Zk9RdDV2cGhMYnB0MEtOWGV6TWNjSW5LR2lYTFlZcE4xZzc4T0J5aFR1NU9JOGE2SnhDdkUvMnZXSlBhdjRBWS9GWVBDZHN2QitlODZOWFFBPT1YAQ..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1744962090672&idt=1538&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D69923a2eee5a48dc9d353a7199bf434c62092625%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_format_rubicon%3Dbanner%26hb_size_rubicon%3D160x600%26hb_pb_rubicon%3D0.20%26hb_adid_rubicon%3D1338eb6b1899ab4c%26hb_bidder_rubicon%3Drubicon%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.20%26hb_adid%3D1338eb6b1899ab4c%26hb_bidder%3Drubicon%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D469762048%252C218890240%26cc-iab-class-id%3D482%252C283%26cc-iab-name%3DShopping.Children%27s%2520Games%2520and%2520Toys%252CHome%2520%2526%2520Garden.Interior%2520Decorating%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.dmcgrathbuilding.com%252F%26tyche_code%3DV.20250415.1%26pageos_code%3DV.20250415.1%26config_id%3D1024872_74068_primary_config%26hour%3D21%26day%3DThursday%26referrer_domain%3Dqwxz.dmcgrathbuilding.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250415.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=52899&tan=0f7ce968-0298-4494-abb8-6ca1cc6adcc0&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b46e135c53af47c242b87ce47028bdfb7d38bd5205b41fdd671b8277fb5dc28a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 5980635056
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138445370502
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 4089
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
ec3ea624a4614b7a0026f9d11e986496.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 1379 7 KB
3 KB 553ms
150ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ec3ea624a4614b7a0026f9d11e986496.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 07:41:34 GMT
expires: Fri, 18 Apr 2025 07:41:34 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
112 KB 166ms
165ms Script
application/javascript 142.251.40.136
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

98da9f2e326e27277dd90c781b4eb462e63eda699cc1380c7b0cec2396d33fca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Fri, 18 Apr 2025 07:41:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 114543
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
112 B 113ms
112ms XHR
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 932285411d74101c-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 306ms
115ms Script
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9322854279c27c92-LAX
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:34 GMT
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 286ms
108ms Preflight 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 9322854229ae0fbc-LAX
date: Fri, 18 Apr 2025 07:41:34 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 189 B
222 B 119ms
118ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 949dbe9d3aac1167327f4fb8643e0dd1f6e4778aec6f02db8da2281b96a42877

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 93228542da590fbc-LAX
access-control-allow-origin: *
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 388ms
231ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 8958bd70c23055c52c47b4158442406a11ee27b01a71e3b8eb6533fce1450e28

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json
x-cloud-trace-context: 53837019080212bd02300fbdb7ef2edc
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H3 200 setuid
prebid.intergient.com/ Frame 7CDC 0
836 B 244ms
166ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=99b05105-54db-454b-8cd0-63ab646cf2f9
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744962094&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JQPDB%2BORmKYYM3JAxrI3vTQBvVeTst4Kf%2Bytkd0xexM%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744962094&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JQPDB%2BORmKYYM3JAxrI3vTQBvVeTst4Kf%2Bytkd0xexM%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93228542b8727d7a-LAX
server: cloudflare

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 7CDC 170 B
409 B 437ms
153ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:34 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 7CDC 170 B
232 B 433ms
154ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OGMwMTBkMDAtMjQzMy0yODA2LWYyYmMtZjkwNzJmZDVmZTE0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:34 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7CDC
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=a06edeca-ed44-76a2-e75c-a3bee5373074&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttd_puid=a06edeca-ed44-76a2-e75c-a3bee5373074&gdpr=0&gdpr_consent=

43 B
240 B

97ms
95ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttd_puid=a06edeca-ed44-76a2-e75c-a3bee5373074&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:33 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttd_puid=a06edeca-ed44-76a2-e75c-a3bee5373074&gdpr=0&gdpr_consent=
content-length: 335
date: Fri, 18 Apr 2025 07:41:34 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7CDC
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/34a9b88e-7de8-e4eb-d68b-b54b1a60fd3d?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-R1A5qFxE2p_3JM3urO9luOwPuj3QuHhjvPo-~A

43 B
97 B

96ms
95ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-R1A5qFxE2p_3JM3urO9luOwPuj3QuHhjvPo-~A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-R1A5qFxE2p_3JM3urO9luOwPuj3QuHhjvPo-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 7CDC
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAICLwALNHJQiQBh

85 B
171 B

221ms
220ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAICLwALNHJQiQBh
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1744962095.317789,VS0,VE0
age: 1092
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/png
x-served-by: cache-toj-leto2350058-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 6932

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAICLwALNHJQiQBh
x-timer: S1744962095.011765,VS0,VE87
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
x-served-by: cache-toj-leto2350058-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7CDC
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8670328399276094062&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

96ms
95ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8670328399276094062&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8670328399276094062&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Fri, 18 Apr 2025 07:41:39 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 826D 7 B
1 KB 394ms
129ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 136ms
136ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Fri, 18 Apr 2025 07:56:34 GMT
accept-ranges: bytes
content-length: 67550
date: Fri, 18 Apr 2025 07:41:34 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 tikilink Show response
fundingchoicesmessages.google.com/f/AGSKWxWEbOU_c1V3pbmomIAzrTyq6jrMEO8yaO4Qv6unOYpIOwEPICQa35DnTPkekEeD4X-RH0GF1WshIHF_Ah_GF7jJVM3pY1kXVR1W-oMNDD77wKKxI4aDWx5DSPDAP65vma76RCbpXMzqGUoW6nXj5X9NQ0j7D... 54 B
109 B 163ms
161ms Script
application/javascript 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWEbOU_c1V3pbmomIAzrTyq6jrMEO8yaO4Qv6unOYpIOwEPICQa35DnTPkekEeD4X-RH0GF1WshIHF_Ah_GF7jJVM3pY1kXVR1W-oMNDD77wKKxI4aDWx5DSPDAP65vma76RCbpXMzqGUoW6nXj5X9NQ0j7DDvH_TNVc6eedLMlthITKx3CvvRRC3xZ/_/ads11./showbanner./kitad./adtopmidsky./tikilink?

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bb5d7086bf65dbd8e460d0e8a583b27a2f4ea74ffc957452a1f67ed3b0260bcc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-64c-pfac-AztrtHZapNmOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmII0JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4uFY19JxgE1gwa_rh5iUNJLyC-OT8_NKijKTSkvyi9KS01KLU4vKUovijQyMTA1MDM30DAzjCwwAjaAz6A"
content-security-policy: script-src 'report-sample' 'nonce-64c-pfac-AztrtHZapNmOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 61 B
76 B 427ms
136ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.zZGSFxhC-zI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwICJjNntTPs2dNnBNzdLggm5sF9Q/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16023549773543154165
age: 3490
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 07:43:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 06:43:24 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 51
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxV0l6AP_L4juUJ-2gHW7tGun2c1DqLXfUCogd4_W6cuxijIxSYnNwDPI418BpVeC0O6N3CY_jtbJYmJZHPbtK9MMzd7Pr1w8DkH2_xJ54n4nbLQm1KDT_4BPP7S3By-KwNK_OnGvw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 305ms
160ms XHR
text/html 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxV0l6AP_L4juUJ-2gHW7tGun2c1DqLXfUCogd4_W6cuxijIxSYnNwDPI418BpVeC0O6N3CY_jtbJYmJZHPbtK9MMzd7Pr1w8DkH2_xJ54n4nbLQm1KDT_4BPP7S3By-KwNK_OnGvw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-smmcUwsPLSsn8W41xbtNeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAvxcKxr6TjAJnDgxf52ZiWXpPzC-OT8vJLUvBLdxJRiXRC7KDOptCS_CIWdWgZSkZOfnp6Zlx5vZGBkamBiaKZnYBZfYAAAVVgkTQ"
content-security-policy: script-src 'report-sample' 'nonce-smmcUwsPLSsn8W41xbtNeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 227ms
225ms XHR
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

48bbafb7ad090b4430c021ddbf346f447843cd529b5e086eb114c78c11726fb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 225ms
224ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 347A 5 KB
2 KB 277ms
85ms Document
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 1291
apigw-requestid: JMuOshSXvHcEPtQ=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 93228544dab5cb83-LAX
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 07:41:34 GMT
last-modified: Fri, 18 Apr 2025 03:16:07 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 13F5 0
0 161ms
160ms Fetch
image/gif 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu6mkyYicYWV7ssLozKn50GV1tx2gcFVSiG5tx_i-pMlH9csCYDPVg19NYYjfiMFycMuBElMdPTekd9iYLwBxDIdZkExd0HRv6GQg0blSCRThzEzJcDi6DDrczuqHPtcZoigRn3214FmQ2I7V4Biw53f_mr3owonpNvfhg95hQSEREAWfKd-kzuUUxfqeyWWMOmDttoatVqwmIuPCaiFHdF7Tn3vc-lLYTrdEPb4wv2LLtlqxe6lUa4GgIaI6czkJG6xGJFROMjUYxzpcFJVYYkwOlwXFsJiSlmE8Tk-UpJIKYaCpq1SwjCBBu-slqjBP8qTs84okgWlbTTDsDyhibEXTzmmXYNHtf2KQz9ynxPQZAk6gRCJP1bScvs617m95R3bAA8V2lh1zagyGj_fefPENE6Dq340AXkLXMDYCHjLka5q441x5eb9b_2zD4ZXxxsYCooGlECcxm0iLo0JTbxbsgG6XOmFkczVDAKsgYl5laB5kOtd31R8DQ1GWCxv2uTUIi1EttBa_gjVsJgDUaD-PeexU4aug5IWi5BxomxOQqh8oziuj50r62qHsuew-FnU0liaA7YeVbSvwJ-I35aqgLW&sai=AMfl-YQ5k4s6UOjzn-LMAwz0Ibx9UIN13FasCJnNxaM25Um2RzZOm6D4mXZiK-K_0YxidxqQ5-blA4Lu-rGRQU8owuC10I9UzsQ8UPKKcd5IocUIJQxpMU8d1oGvg7M&sig=Cg0ArKJSzG9-rslK4718EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E763 663 B
254 B 440ms
156ms Document
text/html 142.250.80.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCy2IEGEKqMkp4GGOfhna8CMAE&v=APEucNV7YlUlVJYZ1i-bCOdOZEXmJNyKdC87RxrPBguMv160LfBTUwn4O2DbKXUBNfq1kpDf4bUeYrDq_bZOlOl1nhWtb4RRWg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f2.1e100.net

Software

cafe /

Resource Hash

962d6dea088b031cd44d33f937adb5ba241a9435aa32a8be667d57482b8bbe1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 07:41:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 13F5 110 KB
37 KB 401ms
243ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 18146946010209014275
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 07:41:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38116
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 42 B
63 B 579ms
422ms Image
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BxXV3PTwSV0hlQGBWHS8ZEqh2MlwqauvwK16hCjfrXu1VqeaF-WEfOuJC5GMQ5LFKSLZHzx9DdiOzdUqapre7x8BYNPeO2AurAmNR9tr3jHjwzap4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Apr 2025 07:41:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 ece64ddf-e38f-4c45-b9ec-edfa8deb82e2
beacon-iad2.rubiconproject.com/beacon/d/ Frame 13F5 43 B
227 B 433ms
131ms Image
image/avif 2602:803:c002:200::64
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL

https://beacon-iad2.rubiconproject.com/beacon/d/ece64ddf-e38f-4c45-b9ec-edfa8deb82e2?oo=0&accountId=12556&siteId=110932&zoneId=523774&sizeId=9&e=6A1E40E384DA563B16D7C5119042AE025F7F118EC0DA6D5651DB47B591097D0C8D7F753B5FAD53DB6053C963B4B7DF7C453DD38BBABF9B309699A5382C415A839B2C4BD7654DC37F9DC4E5E7510F723E5FDC0B5E992A13F7D53E61F3BEEA7BD49D9339A1BE235EC625935896AF6CB6D8F496B007FA9EE913F5C48175178B4E98A4807159A91CEC885CE08E0D0F91AD0FA325D9848BD48EAB8D05BB781E854506B49B44F0F30BB38ABECA051084B4671E411DAB1F7F5DC6DB

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2602:803:c002:200::64 , United States, ASN26667 (RUBICONPROJECT, US),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-content-type-options: nosniff
expires: 01 Jan 1970 10:00:00 GMT
content-length: 43
x-xss-protection: 1; mode=block
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/avif
x-frame-options: DENY

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 13F5 221 KB
68 KB 294ms
137ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 18003062906086184080
age: 280
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 08:36:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 18 Apr 2025 07:36:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69570
x-xss-protection: 0
server: cafe

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 6FF9 269 B
379 B 136ms
136ms Document
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Fri, 18 Apr 2025 07:41:34 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 36FC 52 KB
17 KB 692ms
221ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 68004
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 18 Apr 2025 07:41:35 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1503917, 110189
X-Served-By: cache-lga21993-LGA, cache-mad2200138-MAD
X-Timer: S1744962095.321845,VS0,VE0

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame D84A 813 B
1 KB 120ms
95ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: c44bfd3cdc69cdc06bf7d4f0fa7e9d70595c8c159a012061749fc6ee6aea6d6b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 813
content-type: text/html
date: Fri, 18 Apr 2025 07:41:34 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame DBE6 0
0 468ms
136ms Document
text/plain 104.248.127.106
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.248.127.106 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Fri, 18 Apr 2025 07:41:35 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame CE5F 11 KB
5 KB 258ms
113ms Document
text/html 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 844f8cb302b0fea0d7af2a67677ac56840342a5f4d85d101db80187881280771

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93228545482369c7-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 07:41:34 GMT
expires: 0
last-modified: Wed, 16 Apr 2025 11:15:45 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 4406 2 KB
1 KB 374ms
124ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 07:41:34 GMT
server: Kestrel
server-processing-duration-in-ticks: 79109
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2

200

sync Show response
eb2.3lift.com/ Frame B9B0
Redirect Chain

https://eb2.3lift.com/sync?us_privacy=1NNY&
https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1

1 KB
2 KB

138ms
138ms

Document
text/html

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 5ea782f8bd41cd4cf543ea97a817ec648f3758efa73a80864b910fba739e6d1c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 07:41:35 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
location: /sync?us_privacy=1NNY&&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame FC84 20 KB
7 KB 135ms
135ms Document
text/html 23.41.168.202
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.202 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-202.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=118542
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Fri, 18 Apr 2025 07:41:34 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 0804 3 KB
2 KB 230ms
82ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 1182
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 932285455aa4f049-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 18 Apr 2025 07:41:34 GMT
expires: Fri, 18 Apr 2025 11:41:34 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 128ms
125ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=DwvowV9qRDVaRktnS1l2aU4xUEpPVmx0WkdIN2p6V0VFQVZuUGg5NU9jYyUyQlNoQ2ZHSiUyQmdOQXpETW9PMnVodnZUaFA2VkxXdE1vWmNGbGxkZEpJJTJCTWtTbFdQeGE4WTBxJTJGZzNKQzdUNkxSWDBIc3NqQzFHVWdzYUJUZHJONEtWeGRVcCUyRk0&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 18 Apr 2025 07:41:34 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 319991
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 320ms
317ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
661 B 135ms
134ms Fetch
application/javascript 34.232.220.61
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.220.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-220-61.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: cb5463659df599aebaf74cf3e6d3a6e74e3a53b65170f9097198c10bc321d15b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 102ms
99ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&us_privacy=1NNY&tp=qaat8PaL8MnwS7NsuysAS8lQge4EHWcV9jUosBGseok%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7c8be61d2eb3b9a103e32595ebd2d69314d5bf2e581ddf8e6b65f0cc5087cdf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
0 2ms
2ms Fetch
text/plain 44.209.74.43
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01js3xgzgv0vv4xywespxbts4q&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.209.74.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-209-74-43.compute-1.amazonaws.com
Software: /
Resource Hash: 7eb8832471bb97c3ede3bb2c4014f0de59567ff0c92158258790f2c2eb5daf7f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 91a983774d2aae63
request-time: 8
access-control-allow-credentials: true
expires: Sat, 19 Apr 2025 07:41:32 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Fri, 18 Apr 2025 07:41:32 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 130ms
129ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 227930
expires: 0
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

rubicon
match.adsrvr.org/track/cmf/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a6f45e70-9fec-4876-9b21-5a0eb157edc8&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

70 B
473 B

97ms
97ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 70
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
server: Kestrel

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: becaca8a9ded23e47987329048628358
content-length: 0
Content-Type: text/html

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 525ms
141ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxV0l6AP_L4juUJ-2gHW7tGun2c1DqLXfUCogd4_W6cuxijIxSYnNwDPI418BpVeC0O6N3CY_jtbJYmJZHPbtK9MMzd7Pr1w8DkH2_xJ54n4nbLQm1KDT_4BPP7S3By-KwNK_OnGvw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-szWOAo5u7ZowBhCEhQzieg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAvxcKxr6TjAJrDi14U5zEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAAXkUkbQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-szWOAo5u7ZowBhCEhQzieg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

264.gif
id5-sync.com/k/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*H7Ymum0ek8A1MPbqaUxb7qArXsdNFjdkp4HognlMkBwPncldbotzG5wVd0eXVHxc&gdpr_consent=undefined&gdpr=false
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F7%2F2.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/429/7/2.gif?puid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F6%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/6/3.gif?puid=u_d28d67a4-2db5-4f05-80c2-5931a9363fbf&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F5%2F4.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/5/4.gif?puid=46f929ec-f4bd-4324-930f-77f6788d711c&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F4%2F5.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/4/5.gif?puid=d30657d1-c05f-4c80-9115-cd7da89e3f8d&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/3/6.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/3/6.gif?puid=5713953459701352546&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-57bcR5_XGR-xsjNDzR83iqoaHmeXc72NAKxbU83UxQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F2%2F7.gif%3Fpuid%3...
https://id5-sync.com/cq/483/124/2/7.gif?puid=8836de93-a46d-4245-b4e9-c1e96ce2e0c1&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F1%2F8.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/1/8.gif?puid=5967c3cc-e428-4fa4-824b-3bd9530bd4ff&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttl=%%TTL%%

43 B
1 KB

224ms
224ms

Image
image/gif

162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/k/264.gif?puid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttl=%%TTL%%

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 07:41:38 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

location: https://id5-sync.com/k/264.gif?puid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttl=%%TTL%%
content-length: 199
date: Fri, 18 Apr 2025 07:41:39 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D84A
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=5713953459701352546

43 B
61 B

95ms
94ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=5713953459701352546
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=5713953459701352546
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: f2c571cd-8ef3-4301-9546-2864e0501055
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame D84A
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=8266a854-8cc5-4f1e-a243-323c3ffac0e5
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8266a854-8cc5-4f1e-a243-323c3ffac0e5

42 B
320 B

120ms
119ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8266a854-8cc5-4f1e-a243-323c3ffac0e5
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8266a854-8cc5-4f1e-a243-323c3ffac0e5
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame D84A 95 B
766 B 247ms
97ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=d1dea4ce-1a85-44f9-b7db-2a1935ed6031

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D84A
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=aa9a8ae0-1e34-43fc-82db-afde21cfdf17-6802022f-5553&gdpr=0&gdpr_consent=

43 B
61 B

95ms
94ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=aa9a8ae0-1e34-43fc-82db-afde21cfdf17-6802022f-5553&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=aa9a8ae0-1e34-43fc-82db-afde21cfdf17-6802022f-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D84A
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=bd64ef9f-2711-4c04-9412-b41455b911ac

43 B
61 B

98ms
95ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=bd64ef9f-2711-4c04-9412-b41455b911ac
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: f4a2d420-2540-4548-b1f3-4f7b247ef13e
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=bd64ef9f-2711-4c04-9412-b41455b911ac
Content-Length: 112
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame D84A
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=CPZdDugEwFAbTv541Xibhw==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

78ms
76ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 225ms
223ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

18054b3b668aa45ef37c662d30b6d663d0f3d5d79ed3b8c411fed9007f28cfa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: application/json
vary: Origin

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 6FF9 43 KB
0 136ms
135ms Script
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: d5bac0b19c9b62dafe59ea2542333d9716a454baa9e65ce236f076f748d052fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=24784
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:34:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Fri, 18 Apr 2025 07:41:33 GMT
last-modified: Thu, 17 Apr 2025 14:34:37 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3

200

setuid
prebid.intergient.com/ Frame 826D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY&us_privacy=1NNY&khaos=M9MHDK6C-23-KJX
https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9MHDK6C-23-KJX&us_privacy=1NNY

0
879 B

158ms
158ms

Image
text/html

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9MHDK6C-23-KJX&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744962095&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Orq2R8huWiFy1egl9SPyNRm48fsYNh3Ha34rfP%2B7CII%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744962095&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Orq2R8huWiFy1egl9SPyNRm48fsYNh3Ha34rfP%2B7CII%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 932285484db37d7a-LAX
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9MHDK6C-23-KJX&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
content-length: 0
Content-Type: text/html

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame FC84 5 KB
6 KB 426ms
133ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=46809876&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c12c14f78d945c7923ba508d3ab63b42b9aa55f2265e870e490d217dcfd50294

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 160ms
159ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 932285477fadc798-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:35 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 257ms
116ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 93228546be0bc798-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 07:41:35 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame 347A 0
140 B 271ms
125ms Ping
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 932285486b772f50-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Fri, 18 Apr 2025 07:41:35 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 262ms
118ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 93228546bb1d527b-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 07:41:35 GMT
server: cloudflare
vary: Origin

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame CE5F 19 KB
7 KB 230ms
82ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 93228546fd112ed0-LAX
access-control-allow-origin: *
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame CE5F 4 KB
1 KB 110ms
108ms XHR
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe7a64c2fcfbbe178b8d322e43fd5a1c2f9e063c4ee0a188dee72bcf12b44661

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9322854618b369c7-LAX
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 97D5 0
100 B 406ms
134ms Document
text/plain 50.17.193.8
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.193.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-193-8.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 223ms
222ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 826D
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9MHDK6C-23-KJX&us_privacy=1NNY

0
467 B

367ms
126ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9MHDK6C-23-KJX&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: BDDBDDD230954B34A5578ED8F2BEA712 Ref B: LAX311000113047 Ref C: 2025-04-18T07:41:35Z
x-li-fabric: prod-ltx1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYzCKXZc+7N4B5pByXexQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9MHDK6C-23-KJX&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Pragma: no-cache
content-length: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 826D
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjBhNzdjODI0ZGEzMjcwN2Q1ZDU0M2U4ZWMyMDlkZjMyYzNiZGU5Mw&us_privacy=1NNY

170 B
232 B

153ms
151ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjBhNzdjODI0ZGEzMjcwN2Q1ZDU0M2U4ZWMyMDlkZjMyYzNiZGU5Mw&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjBhNzdjODI0ZGEzMjcwN2Q1ZDU0M2U4ZWMyMDlkZjMyYzNiZGU5Mw&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 29af2665c43893332e84c235bac366c1
Pragma: no-cache
content-length: 0

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 826D 170 B
232 B 157ms
152ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 826D
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/8pnsva1FVC7V1_zt_WkmGQ?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-JxoKsCVE2oJ6VxxReY_PTfgvHR9y8.QsDWguFw--~A

42 B
1 KB

157ms
126ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-JxoKsCVE2oJ6VxxReY_PTfgvHR9y8.QsDWguFw--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-JxoKsCVE2oJ6VxxReY_PTfgvHR9y8.QsDWguFw--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

usersync
vid-io-iad.springserve.com/ Frame 826D
Redirect Chain

https://pixel.rubiconproject.com/token?pid=52948&gdpr=1&gdpr_consent=&us_privacy=&rk=iad&us_privacy=1NNY
https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=M9MHDK6C-23-KJX&gdpr=1

43 B
206 B

403ms
131ms

Image
image/gif

52.3.13.59
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=M9MHDK6C-23-KJX&gdpr=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.3.13.59 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-13-59.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-origin: *
content-length: 43
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
server: nginx
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=M9MHDK6C-23-KJX&gdpr=1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 826D
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY&dcc=t

43 B
855 B

394ms
153ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: V3V9MG42VT81DQYXVJV3
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 80MH10VM7TFQ0KSJHP25
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 18 Apr 2025 07:41:35 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 826D
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlNSERLNkMtMjMtS0pY&us_privacy=1NNY

170 B
188 B

153ms
151ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlNSERLNkMtMjMtS0pY&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlNSERLNkMtMjMtS0pY&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 382e2818ca015d35b02cd449aa60881d
Pragma: no-cache
content-length: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 826D
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YTZmNDVlNzAtOWZlYy00ODc2LTliMjEtNWEwZWIxNTdlZGM4&gdpr=0&gdpr_consent=&ttd_tdid=a6f45e70-9fec-4876-9b21-5a0eb...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&google_error=15
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=a6f45e70-9fec-4876-9b21-5a0eb157edc8
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5713953459701352546&ttd_tdid=a6f45e70-9fec-4876-9b21-5a0eb157edc8
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a6f45e70-9fec-4876-9b21-5a0eb157edc8&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D5967c3cc-e428-4fa4-824b-3bd9530bd4ff%252Chttps%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=5713953459701352546&pt=5967c3cc-e428-4fa4-824b-3bd9530bd4ff%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a6f45e70-9fec-4876-9b21-5a0eb157edc8&ttd_puid=
https://dpm.demdex.net/ibs:dpid=540&dpuuid=5967c3cc-e428-4fa4-824b-3bd9530bd4ff&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=11667705955099124354093122845110259523&pt=5967c3cc-e428-4fa4-824b-3bd9530bd4ff%2C%2C

95 B
124 B

99ms
98ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=11667705955099124354093122845110259523&pt=5967c3cc-e428-4fa4-824b-3bd9530bd4ff%2C%2C

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=11667705955099124354093122845110259523&pt=5967c3cc-e428-4fa4-824b-3bd9530bd4ff%2C%2C
dcs: dcs-prod-va6-2-v076-070288b26.edge-va6.demdex.com 7 ms
pragma: no-cache
x-tid: TJGhozuYSCg=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 18 Apr 2025 07:41:36 GMT

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame 826D
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY&dcc=t

43 B
855 B

372ms
371ms

Image
image/gif

54.239.33.158
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

54.239.33.158 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 0VDVGKPA0SG7T6A0B602
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 18 Apr 2025 07:41:36 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: XGMEHNZNHKNX9ZXTVM9H
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Fri, 18 Apr 2025 07:41:35 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 826D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=M9MHDK6C-23-KJX&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

291ms
133ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=M9MHDK6C-23-KJX&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: NG5XGZXS39A56PV630GF
Content-Length: 43
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=M9MHDK6C-23-KJX&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 826D
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAIpx07QBAQAABnut0EP4g&expires=30

42 B
1 KB

127ms
127ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAIpx07QBAQAABnut0EP4g&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAIpx07QBAQAABnut0EP4g&expires=30
Content-Length: 0
Date: Fri, 18 Apr 2025 07:41:35 GMT
Server: gunicorn
Connection: keep-alive

GET
H2

200

ProfilesEngineServlet
syncv4.intentiq.com/profiles_engine/ Frame 826D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&us_privacy=1NNY
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=M9MHDK6C-23-KJX&us_privacy=1NNY
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9MHDK6C-23-KJX
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9MHDK6C-23-KJX&ckls=true&ci=0VfLMGIL5c&nc=false&trid=-2004160915

43 B
1 KB

440ms
150ms

Image
image/gif

3.168.122.117
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9MHDK6C-23-KJX&ckls=true&ci=0VfLMGIL5c&nc=false&trid=-2004160915
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.168.122.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-122-117.jfk52.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 2719b1b5cd0af422e4658c2da505a4d6.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: FWIT1-a7JjPiqhLB4iTYn7bUIJeAOJEKrRdtSQDhmrxbOkq3qOA8rg==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9MHDK6C-23-KJX&ckls=true&ci=0VfLMGIL5c&nc=false&trid=-2004160915
pragma: no-cache
via: 1.1 a68875d0f24bed2038b9d7b3529854bc.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: yHh_Slm9MhEdXQ54nu_mUxzsLuoZDmKgODaicx42uAFa6iMBRlSezQ==

GET
H2

200

setuid
pbs.yahoo.com/ Frame 826D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-yahoo-exchange&us_privacy=1NNY
https://pbs.yahoo.com/setuid?bidder=rubicon&uid=M9MHDK6C-23-KJX&us_privacy=1NNY

0
456 B

456ms
157ms

Image
text/html

2001:4998:14:800::1000
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://pbs.yahoo.com/setuid?bidder=rubicon&uid=M9MHDK6C-23-KJX&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
x-envoy-upstream-service-time: 0
age: 0
x-envoy-decorator-operation: pbs--production-usea5.mediaplatform-gcp-prod-monetization.svc.cluster.local:4080/*
referrer-policy: no-referrer-when-downgrade
expires: 0
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: text/html
vary: Origin,Accept-Encoding
server: ATS

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://pbs.yahoo.com/setuid?bidder=rubicon&uid=M9MHDK6C-23-KJX&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
content-length: 0
Content-Type: text/html

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 826D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&us_privacy=1NNY
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=M9MHDK6C-23-KJX&us_privacy=1NNY

68 B
324 B

412ms
130ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=M9MHDK6C-23-KJX&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-202-124-0.compute-1.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=M9MHDK6C-23-KJX&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 826D
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=bd64ef9f-2711-4c04-9412-b41455b911ac&expires=30&us_privacy=1NNY

42 B
1 KB

126ms
126ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=bd64ef9f-2711-4c04-9412-b41455b911ac&expires=30&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: 45acbe80-4e81-46e9-b2e4-1c00cacc1de4
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=bd64ef9f-2711-4c04-9412-b41455b911ac&expires=30&us_privacy=1NNY
Content-Length: 164
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

pixel
capi.connatix.com/us/ Frame 826D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1NNY
https://capi.connatix.com/us/pixel?puid=M9MHDK6C-23-KJX&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY

0
329 B

176ms
84ms

Image
text/plain

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=M9MHDK6C-23-KJX&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 9322854c1a2d2b9a-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=M9MHDK6C-23-KJX&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
content-length: 0
Content-Type: text/html

GET
H2 200 PrebidServer
crb.kargo.com/api/v1/dsync/ Frame CE5F 43 B
369 B 461ms
131ms Image
image/gif 18.204.139.163
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/PrebidServer?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dkargo%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.139.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-139-163.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 43
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
vary: Origin
x-accel-expires: 0

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame E763 170 B
232 B 157ms
156ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCy2IEGEKqMkp4GGOfhna8CMAE&v=APEucNV7YlUlVJYZ1i-bCOdOZEXmJNyKdC87RxrPBguMv160LfBTUwn4O2DbKXUBNfq1kpDf4bUeYrDq_bZOlOl1nhWtb4RRWg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET cs
cs.lkqd.net/ Frame E763 0
0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame E763
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&C=1

43 B
342 B

85ms
84ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCy2IEGEKqMkp4GGOfhna8CMAE&v=APEucNV7YlUlVJYZ1i-bCOdOZEXmJNyKdC87RxrPBguMv160LfBTUwn4O2DbKXUBNfq1kpDf4bUeYrDq_bZOlOl1nhWtb4RRWg
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SwJ%2FYUqVUdCUZey3VcLy3p3S4trzoKwC%2BmgMgIls18rzX2p%2F5CrP7HaIlE%2Bp7CALoIv%2FNb1kNjTmxQDpm8VUPEGwIeQjrj7o96Ftw52FBkGcx04OXE34dU3Y2UsqmS%2Fa%2BuPZAu3lgn2Upw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 93228548d890979e-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=&google_error=15&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=watDXl2SMtpcBfVbJkEgixkyv9vsEA%2F0kaKjDXr0P%2BbzOdAIpdvoGJOkvLQ3LHb6Y5Wi3HMdgF0MRD9R0fDXwljzHPbb2mb7bdd2mY4QfahLe9ui%2F7DPB0XWN6YgbVKmWwYieLU0ix47hw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 932285482f11979e-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E763
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAICL8AoIrYAFRG0AYuQOQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
802 B

92ms
92ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCy2IEGEKqMkp4GGOfhna8CMAE&v=APEucNV7YlUlVJYZ1i-bCOdOZEXmJNyKdC87RxrPBguMv160LfBTUwn4O2DbKXUBNfq1kpDf4bUeYrDq_bZOlOl1nhWtb4RRWg
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hYkLDe78bfzXJugX6IHZe%2FSAErTLHganIrH%2BOash07gI1PnMq00hhkRyln5Kr%2BbAWRwUhDdIxJM6JdiSI7bBdfd2PxkgJzdxO1gwhOkR2xJbqGnrwuFCCUvox%2FkeqDKw2PivLRRfuSLzgg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9322854a4cec525d-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 298ms
154ms Fetch
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504170101/pubads_impl.js?cb=31091857
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame B9B0
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

140ms
139ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=a6f45e70-9fec-4876-9b21-5a0eb157edc8&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Fri, 18 Apr 2025 07:41:35 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame B9B0 170 B
232 B 157ms
153ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B9B0
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzY4NjU4NzU3MDY3MzUyODMwODMxMQ%3D%3D

170 B
188 B

153ms
152ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzY4NjU4NzU3MDY3MzUyODMwODMxMQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzY4NjU4NzU3MDY3MzUyODMwODMxMQ%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 07:41:35 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame B9B0
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzY4NjU4NzU3MDY3MzUyODMwODMxMQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

138ms
137ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame B9B0 0
147 B 324ms
127ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3686587570673528308311&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: B1195C6089774EE39BC95F6EE937A54B Ref B: LAX311000113047 Ref C: 2025-04-18T07:41:35Z
x-li-fabric: prod-ltx1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYzCKXZgpwBSvq/siWGKA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT

GET
H2

200

sync
pippio.com/api/ Frame B9B0
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=3686587570673528308311
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=3e988202-6641-4faf-af22-7fe6c4a61a00
https://p.rfihub.com/cm?pub=39342&in=1&userid=4192d0d1-8452-4911-999d-8c6361cb5950%3A1744962096.1897812&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D4192d0d1-8452-4911...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969751711457396693&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D4192d0d...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=4192d0d1-8452-4911-999d-8c6361cb5950%3A1744962096.1897812&pid=500040&it=1&iv=4192d0d1-8452-4911-999d-8c6361cb5950%3A1744962096.1897812&_=174...
https://pippio.com/api/sync?it=1&pid=500040&_=1744962096.191794&iv=4192d0d1-8452-4911-999d-8c6361cb5950:1744962096.1897812

42 B
344 B

267ms
122ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1744962096.191794&iv=4192d0d1-8452-4911-999d-8c6361cb5950:1744962096.1897812
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 18 Apr 2025 07:41:37 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1744962096.191794&iv=4192d0d1-8452-4911-999d-8c6361cb5950:1744962096.1897812
Content-Length: 0
Date: Fri, 18 Apr 2025 07:41:36 GMT
trace-id: 23e3999d9a3cc976
Request-Time: 0
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame B9B0
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/3686587570673528308311?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-iOk._h5E2oRIrrLQKCfgUOOILwywNYc0m.O7o3_PLw--~A&dongle=0883

37 B
476 B

141ms
140ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-iOk._h5E2oRIrrLQKCfgUOOILwywNYc0m.O7o3_PLw--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-iOk._h5E2oRIrrLQKCfgUOOILwywNYc0m.O7o3_PLw--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame B9B0 42 B
690 B 344ms
115ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=3686587570673528308311&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "e8cf83ed75a9db1:0"
x-msedge-ref: Ref A: 9339D052AAB847E19CAF085BB37B94D5 Ref B: LAX311000109023 Ref C: 2025-04-18T07:41:35Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
last-modified: Wed, 09 Apr 2025 17:36:29 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame B9B0
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=2c4f8c7bad8e0763&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAA8otJskh6TQJuvr_rAQEBAQEBAQCXRtmKZQEBAQEBAQEB&expiration=1745048495&is_secure=true&gdpr_consent=&gdpr=0

37 B
476 B

141ms
141ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAA8otJskh6TQJuvr_rAQEBAQEBAQCXRtmKZQEBAQEBAQEB&expiration=1745048495&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAA8otJskh6TQJuvr_rAQEBAQEBAQCXRtmKZQEBAQEBAQEB&expiration=1745048495&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame B9B0
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430

37 B
476 B

140ms
140ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430
Content-Length: 141
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 227ms
225ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

23616b4b3a0c0eb055ea31aace2ae029a17bbff520b7c8c24629dc63c69aaa4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: application/json
vary: Origin

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
20 B 154ms
154ms Ping
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3031313355925&version=m202504010101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
20 B 154ms
154ms Ping
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3031313355925&version=m202504010101&ct=76&x=8&cor=14384139421140020000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 13F5 115 KB
44 KB 455ms
183ms Script
text/javascript 142.250.80.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJ17UH0RfEk_Aeind7VMGL08MNsd1lSeBrm46BqntpFdBePkaTKosRB5_aYekV6WgQY5PxDT6Oa-2M05OJjkIGSLM_EYHBsKyef0moLXbzDV-LvLSoHkdFGOfSVcqMJBFBEh2WHzZtwJsRI6A2DLPMpvCICK8fpjRjaiELqSwBA6BF3o5fXYjUBPWms3PaMo85UMBc50JOIm5gqRgPMRAtHGNDqfLxWuZAOg8j3MzS3XIulN3TnbEq9mLbRbrWfGHQogGZnNPoRhoFz1UJ2Yi8qrTIBg&dbm_d=AKAmf-BJIgjOE9DjJyqqTjyJgGK0a5jWOgvjpnUW50bB6WtIDrE9QqcJ0jSLCyf3Iv3aEQIwvcX1FbinhBLrT-shFf1yfxp-DSfU96mStkO3JUcd-nPcv50ECb6vBeHG_dRWvq_f9lUuJZ3iYXSj_x-xUumWpuWU8oOquR7Po2ueso97kxO6KyEw9IziRZaYQSxfacHStE8COxzX-hoEkwZw2-dT2mUuW59Jhrf6B-Zeilsd6OrcFW9H05MiQtU-sOPRpTB8kVd7sZWhfDT4AFV6RYBtkt0oLy8OgkoBVRWUDetjYrfNAkn1g0QZZqOxLcu6gw_VRsU6UOLxa1bn-w4oHK3nLZiMDCPRjqTf1tuOqC2ios0LlXqUCQAcLqoQDEYki8hSczSyuHQE3qMZGrHpquouU7dNafY8wYWCq0tlfk1GxtbWCMcMKt9c6gPI4pkHO1bKt98XDlWRDOy2VVX7VRL7MSX7dmg8QCsGfIBAaNoc5nbvt6JJ62Jhug6zALmubDR8uNJ9_L9gS0SNA3rBXRGMSZ8f4O0bHFZd0b3XOf0nQy2aOw4R3pfxLqMfCzt1FxGuOtBc8a76aVk8fKthFbAcIJg_6oifMEOJM3KXSwUmXwetcnK_kmvacWvIbv1kFzVr20GK32PmeUyCouIH5XR_a4u2NfVEXMKFPXTH77oWBPzQh4ebVZwFqim1npH0WkLa8MVxy1NZFFbRxmq8t4VC5lI6UntNXXpjT82R191HKkW4fy54GKAdQwoPRClv1vehDG3LzGbqBZy4lWspHSJQh5bCp_IUZBoUIRW0kzxN7wkTCqkbSAVdtt8aMDo6zRdmwUB186R2-5oobt173yZx_1VIfmry7NRv8EEkv-AC_ZwElEzLG31b67CLZJ4Rq0OmoWiC8DFmWPud0go4sUnl-P5NGKWJdgoIkleZt1e_7lCCdOca2-6OejAfQoLfM0uIaBQxRaFDVRPdZ6XhjoWSrik7lvEO-nCyEhfdiGwIMVk1-K4RKK4gCqE0vmavWAmBnlTA16sIOAXhF360V2YKS9soZAHIJMvcqWQ4HggwYycXgIzhYTOxgkUrl_5i3Gr1loELKETeQ-Y7Lk_ejb_TUnLEFE3733c79obo2B46zINx7Uo_loOJGlsw-xkqm3kVrt9kJXd3JxpLQHD2hR-1C8LM_ASWBUGJVg3Ae2rtxKHUPBW7wUORvPm6IH4_1sLo1Xce9G_aufpWLUgv0LMflB-tsxvVLj10ZX6ufBTHK5rc2o2pNTQdeILlVWNp1LAsPaSO4O-ynRSjflhMf2JoFvs37Ckm0G5cBJtxHkfnXBH9iuM2X-9VsAuR63Xf2wjxr2mz3uxzLi2eCg2XmFPu0BvwDmMBIh9mcTWIbQ8d7Gind2crkwbE5P_b4bgkL_gv32nkWnVFj9ixC7qrQJHkFyknoAiBESWKdfO5C4Iev6VK3QwtZbpxM2wNHk8IzWclUkRU6eBI0z6bOJYaW8vqc2nNj1o2voZtuJdw5JRz-RCuzJP3vo97TfUMJnTDqOf4PF54_GAC5MVZamQm2oWS6NHnhWiJIOQO5lRidVmRsr17W53YcojTi1aC3zFJVbowrJLvxW4BFb1ipvjy2G7jr0nvKUxpWKqqbjSMoMk3pyx43cCaljQqzI0KVPqqQJOFG3P1gqKPe3sHY189QojX9UbiCzoy6iNo0GuuF8neEU-JY4NlzX4o7R-iL5v3c4D8cMHOREWV-KcDW0cG7clQ1PGboFzpcBpzAxvsoSXvP25QlICmAPViBFlWpX2af9-YfQjPnNZCcPSptlbo24QXo340ap6oM5ux7bnRFErsmN7in8Cur8kkOA0myiIYpRAk9SngdCPH8k6X8ndN5fcJtzrJ2jiAuCLU_GEYjzVTpms81WhN4vr7yADfPUF1Xk5rfVQ8cCGF2mpKTwKf9JJ5JOeP9u5oUjq6kQaZzPOgAzUX7fYo-Jx3YxnJMSJ84qMcQETF3JsPY5gwfM0uEnWyYeLAJgxDN_-o6ehwmRTiJKiZdI_Vu5KOdlPxIub3o173ucgOlWlElFBJVz6KXIEEl32NQyiv9jLwdZoscERqLAcbaL0uL_-RIAPeR043rQLrBckouaPdx7YYDL0ish2wn4fiupg1ZIzhvy5XCkuksDc7sfvPTZo1WHtmvHrPL6WiaM-ZIqa6wnrNK8_e1DaJYWsE57U1zxywALNXlfiFC_wMnng4JrUrZg30VcA5YPDvp92f0TdXqsvr-QuKCVZIR6Wzw8or0L1ARne37Dn3mMwwpAuMRTueH4WfKSjq6D25JkhaTmMazCWT5mjIy1hxelVeUX4P7zAXFZdkhTQRehvqvI1PLg8-qfOGYL1HbPcym2LS7uIgJw63yTcmopT1_hjEzyJ0h3mNs9-WO1FLo--i-Sx3rohWE3BKao2GZiH_ffrG_xRSFa-C-Pzm-RLgEhMpZRSeN520F1RD0idBQ0e7OvcCVMgzfIlA6JXA9_m-b2uqMu6_O0aTJpxQVUM9R9vYFIDmadzFWkiZaLyYxNpJrDm_9EG_IOC87rimpDWifK27HdczVCa1XX_EUxKcY3w7qrBCfpkUXnv44harmjHtDi6TR9m3leu69bv0bPFPEukKnye39Z2eP7NP9n8Q9orD0Jv0RK1_69CleqwxYuhDrJcd4Xud59Jkgf29kDxrvoePmCBiP8BxrHFKYwfVAdoJPyO6FlbgSR5EWEQuTjxDAcgMXvSXq6OQL1dhgIevhD0JumGO3diwJtuKty486x7Wgo-ODjyl83xkqKAa9L2Jzm-vne1EuOGPJ25-XopCcRc_SWTIlVyytzElWohBais9aK7QqDfXdVqSYt4wwqoBf5cOiYDr3r5KrCd_mnm5DmBPMsDH57ShkWpkbHIPy9lYWJA14xqwiWfAkXwiMCdNMMTesL-kHm3NbNLDWFXbJO8tiB-qiDXIcE5_iVlfcMGH9iwknf87RfNDG8haJKm_pM1MCqAsNG1GwWkazQH13MpQyiebXX9hr41rnjh7-A1VD2Zt4y85Gj494MjlKRkPKsULkoWizQWaxEgb35zOFFzbtGg8P0fccO3_xGJo66DEr8Yw0BkCeRt4T_4TFipJy4jGel-YrRP6jAwhtesd1S2I7BhWikIZAQANabwpIZDqkwCFdFt6dV2B2ifghPVCyZorFEYWODp3tN8T2uDvvF3-UCNaVe2ro6Cqx6DAMmF_GWb1ekTYkaIF4oOivHBCW9QKtRHeAqnLJgNuQLDNR52G5RxKZjaezrOtl6wg0MYi9RHFPgqTBgnzlV9TbgGrVHAEOqdIysjoZ3gOIp30mV1VhAya1PaynCtQ79jeO3Gwf6IHqQyD24qi6L2B8F8f0lAY6urqJRhGOWQorbTm__jy5H9ImIeQWbTrJL8sGLUcVhmetVUEwHKCWLN7aPax9v_xNuWbfhvvavBok_Z0AnBcs1dlGt6DQVPIP-dn2adUdLubcF9RDkJNLjDxyd6Ymv4RP9T62pj2dAv1-3NUX123GgOUqZs9n4-f1ggGTCtof3byKMt9YLy7-4oHPTuTXJvnSn7K_XzBpkpTe7DCnUIyBxmtHnVYmoJJbktrO9q1XV_iZ_MjXtEHbzzrX8O_TKfHvCJOSJzXzRAjrM_JjKA7L41zmHddZxw7tlFrIEer8tikWLJXBQF60TFMKULKeS0DkhBGKT7wn9EI26DcQXRztL9hEaQc7DX1V7VxQfU1SSGriMo_B0WnEH586aClySmZ1lirdL4iACBU3SL4JYQaUsVPuHBO64wzw2tw8qPXnP12sEsrIVwTppwy7a_208HWl9JZR7Ja-x7u250qqXUz&pr=8%3AB3A4C1FB652DECC2&cid=CAQSSQDZpuyznKgKBleYd0QbREWihOE7V4T6qFRMG4pCEghoJcfXrnWuOksmTydbAYfl7_sL8UDVNIhbx2vHSYx8g28gNUvmtC3D1ywYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&ct=76&iif=1&cor=14384139421140020000&adk=4289860714&idt=574&cac=0&dtd=35

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f2.1e100.net

Software

cafe /

Resource Hash

62fb8fa83a3e296da2bf4f3c27a261de3e4e532d014c0069280902d0ec75110a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 45204
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxV0l6AP_L4juUJ-2gHW7tGun2c1DqLXfUCogd4_W6cuxijIxSYnNwDPI418BpVeC0O6N3CY_jtbJYmJZHPbtK9MMzd7Pr1w8DkH2_xJ54n4nbLQm1KDT_4BPP7S3By-KwNK_OnGvw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Hwe4X86pVmflzBdcQWD4UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw15Bi-FB_mfUHEAvxcKxv6TjAJjDh9uXzjEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAAXf0kbQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Hwe4X86pVmflzBdcQWD4UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxV0l6AP_L4juUJ-2gHW7tGun2c1DqLXfUCogd4_W6cuxijIxSYnNwDPI418BpVeC0O6N3CY_jtbJYmJZHPbtK9MMzd7Pr1w8DkH2_xJ54n4nbLQm1KDT_4BPP7S3By-KwNK_OnGvw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BKdHKK5tbbxh7iFUgXcFDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII1JBi-FB_mfUHEAvxcKxv6TjAJjBh0_bzjEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAATeckMg"
content-security-policy: script-src 'report-sample' 'nonce-BKdHKK5tbbxh7iFUgXcFDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXa0wTO4saLOmwe8Ad7TYzvdbv1YUUX7WEtqIyVDaelgodiYIEJRYpEP2slt6AYyUf9Iqase26f4VXKqWtyOXWUMRQ3NhVutJi715vBp8krafVw7Iiru1WD5hRLEyA7upzWqyDpXA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 173ms
172ms Script
application/javascript 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXa0wTO4saLOmwe8Ad7TYzvdbv1YUUX7WEtqIyVDaelgodiYIEJRYpEP2slt6AYyUf9Iqase26f4VXKqWtyOXWUMRQ3NhVutJi715vBp8krafVw7Iiru1WD5hRLEyA7upzWqyDpXA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ0OTYyMDk1LDM1OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ6WkdTRnhoQy16SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmRtY2dyYXRoYnVpbGRpbmcuY29tIl0sWzI1LCJbWzk1MzQwMjUzLDk1MzQwMjU1XV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

ESF /

Resource Hash

e7f839117736b11a17c62095cfba2a101ec5b6a3cf1db033dbfa0004b5e67abd

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-7io1O2KefbuXkmcJY_EmeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmLw0JBiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkFeLhWN_ScYBN4EP3lSuMShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRqYGJoZmegaG8QUGAAmaOOA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-7io1O2KefbuXkmcJY_EmeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame AE22
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=

35 B
591 B

134ms
133ms

Document
image/gif

185.167.164.48
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Fri, 18 Apr 2025 07:41:35 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame D550
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

197ms
150ms

Document
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 18 Apr 2025 07:41:35 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: QAJ5PVPJ0BMBXV4QGW8M

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Fri, 18 Apr 2025 07:41:35 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 0F2JE21QX6R075926GMH

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7FF8
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5713953459701352546&gdpr=0&gdpr_consent=

42 B
219 B

279ms
128ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5713953459701352546&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 07:41:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 686123fe-7c7e-49d0-9cfd-2d000424797e
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 07:41:35 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5713953459701352546&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.244; 162.245.206.244; 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 8BD5 0
339 B 418ms
135ms Document
image/gif 38.91.45.7
COGENT-174

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Fri, 18 Apr 2025 07:41:35 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 0E0C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=0&gdpr_consent=

42 B
376 B

128ms
126ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 01:53:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Fri, 18 Apr 2025 07:41:35 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 54B6
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969751711457396693

42 B
195 B

160ms
160ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969751711457396693
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 07:41:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Fri, 18 Apr 2025 07:41:35 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969751711457396693
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET b9pj45k4
sync-tm.everesttech.net/upi/pid/ Frame 81A5 0
0

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame A611
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFJcHhrN1FCQVFBQUJudXQwRVA0Zw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AAIpx07QBAQAABnut0EP4g&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_par...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAIpx07QBAQAABnut0EP4g&pid=558502&do=add&gdpr=0

43 B
433 B

133ms
132ms

Document
image/gif

107.23.31.177
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAIpx07QBAQAABnut0EP4g&pid=558502&do=add&gdpr=0

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

107.23.31.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-107-23-31-177.compute-1.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Fri, 18 Apr 2025 07:41:36 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-US
cw-server: bh-deployment-cc58c7bc8-lnlvh
expires: -1
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAIpx07QBAQAABnut0EP4g&pid=558502&do=add&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(12.0.17)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 11C8
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=e4fa4c82-5314-4ad7-a4ad-3f221a016889&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=283&user_id=5d3a2ef7-7c17-4b92-ac61-2ca64d315aaa&expires=1&user_group=2&ssp=pubmatic&bsw_param=e4fa4c82-5314-4ad7-a4ad-3f221a016889&gdpr=0&gdpr_consent=&gdpr_pd=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e4fa4c82-5314-4ad7-a4ad-3f221a016889&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
220 B

127ms
127ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e4fa4c82-5314-4ad7-a4ad-3f221a016889&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 07:41:36 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e4fa4c82-5314-4ad7-a4ad-3f221a016889&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 2A53
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=ca6baa6b-d07e-4dd6-8793-9a927043b310&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC

42 B
501 B

130ms
129ms

Document
image/gif

54.82.23.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.23.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-23-141.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Fri, 18 Apr 2025 07:41:36 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Fri, 18 Apr 2025 07:41:35 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET pubmatic
ad.mrtnsvr.com/sync/ Frame C7C4 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame D7A3
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=BN_1ugLV9-4fhPS5VNTo6VHUpO4fgve8B9CvEUzY

42 B
422 B

127ms
126ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=BN_1ugLV9-4fhPS5VNTo6VHUpO4fgve8B9CvEUzY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 07:41:36 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-store, proxy-revalidate
content-length: 0
date: Fri, 18 Apr 2025 07:41:35 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=BN_1ugLV9-4fhPS5VNTo6VHUpO4fgve8B9CvEUzY
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1D04
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=8e2a912f-1c28-11f0-973b-8f69ee17f31a

42 B
243 B

127ms
126ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=8e2a912f-1c28-11f0-973b-8f69ee17f31a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 07:41:36 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 18 Apr 2025 07:41:35 GMT
Expires: Thu, 23 Sep 2004 17:42:04 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=8e2a912f-1c28-11f0-973b-8f69ee17f31a
P3P: CP="NOI OTC OTP OUR NOR"
Pragma: no-cache
cache-control: max-age=0, private, must-revalidate
vary: accept-encoding

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3D09
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw

42 B
95 B

196ms
127ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 07:41:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 93228549ff7dcb9b-LAX
content-type: text/html
date: Fri, 18 Apr 2025 07:41:35 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-function: 209
x-reuse-index: 17

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame AFC6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:349e6802-022f-4f00-a741-1241bb6e0371&gdpr=0&gdpr_consent=

42 B
210 B

217ms
216ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:349e6802-022f-4f00-a741-1241bb6e0371&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 07:41:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Date: Fri, 18 Apr 2025 07:41:35 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Referrer-Policy: strict-origin
Server: MT3 1797 8af0415 master ord ord-pixel-x14 config_version:"316"
Strict-Transport-Security: 31536000
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
X-XSS-Protection: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:349e6802-022f-4f00-a741-1241bb6e0371&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9730
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=JW5M-cLftoI3aDIMDb9OIUaYGhCWHBuvZBzPsxAeXss&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1N...

42 B
350 B

127ms
127ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=JW5M-cLftoI3aDIMDb9OIUaYGhCWHBuvZBzPsxAeXss&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 07:41:36 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT Fri, 18 Apr 2025 07:41:36 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=JW5M-cLftoI3aDIMDb9OIUaYGhCWHBuvZBzPsxAeXss&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 77C6
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUe6febad536e945e5b568e4bfac95d1c0

42 B
418 B

125ms
125ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUe6febad536e945e5b568e4bfac95d1c0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 18 Apr 2025 01:52:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Fri, 18 Apr 2025 07:41:36 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUe6febad536e945e5b568e4bfac95d1c0
pragma: no-cache
server: Tengine

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame 58F3 0
181 B 426ms
135ms Document
text/html 159.89.252.170
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.252.170 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Fri, 18 Apr 2025 07:41:35 GMT

GET
H2

200

362358.gif
idsync.rlcdn.com/ Frame FC84
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_error=15

42 B
315 B

118ms
115ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

mw
mwzeom.zeotap.com/ Frame FC84
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=a6f45e70-9fec-4876-9b21-5a0eb157edc8&icm&gdpr=0&gdpr_consent=&cver
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-oCwa0.FE2pQK8NHVzla3xmE3IFXrs8qoRw--~A&gdpr=0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=e4fe3334acb53a5a8cea788c41f22420&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=ded366a254892122
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=52502ba9-148e-4f60-4251-52389d334f0d&reqId=ea3a2122-f7f8-478d-473d-df5278f3b875&zclui...
https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=52502ba9-148e-4f60-4251-52389d334f0d&reqId=ea3a2122-f7f8-478d-473d-df5278f3b875&zcluid=ded366a2548...

95 B
165 B

237ms
223ms

Image
image/png

2606:4700:10::ac43:28ad
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=52502ba9-148e-4f60-4251-52389d334f0d&reqId=ea3a2122-f7f8-478d-473d-df5278f3b875&zcluid=ded366a254892122&zdid=1332&google_error=15

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700:10::ac43:28ad , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 9322855cce9b2ef1-LAX
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Fri, 18 Apr 2025 07:41:38 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=52502ba9-148e-4f60-4251-52389d334f0d&reqId=ea3a2122-f7f8-478d-473d-df5278f3b875&zcluid=ded366a254892122&zdid=1332&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
date: Fri, 18 Apr 2025 07:41:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame FC84
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&sInitiator=external&gdpr=0&gdpr_consent=

42 B
603 B

124ms
123ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 2
Pragma: no-cache
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Fri, 18 Apr 2025 07:41:36 GMT
Content-Length: 42
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 5
Pragma: no-cache
Connection: Keep-Alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjY2REU4QjMtMEFGMC00RTU1LUE1NjMtQzRCRjk4MjYwQkFD&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
245 B

303ms
125ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame FC84
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Jm3oswrwTlWlY8S_mCYLrA%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
20 KB

136ms
135ms

Image
text/html

23.41.168.202
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.41.168.202 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-202.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=118541
content-encoding: gzip
expires: Sat, 19 Apr 2025 16:37:16 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Fri, 18 Apr 2025 07:41:35 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

430ms
126ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:38A3FBA9A36644AAA46AC2171C11585B

42 B
327 B

165ms
163ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:38A3FBA9A36644AAA46AC2171C11585B
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:34 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:38A3FBA9A36644AAA46AC2171C11585B
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Apr 2025 07:41:35 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a6f45e70-9fec-4876-9b21-5a0eb157edc8&gdpr=0&gdpr_consent=

42 B
392 B

377ms
130ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a6f45e70-9fec-4876-9b21-5a0eb157edc8&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 01:51:44 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a6f45e70-9fec-4876-9b21-5a0eb157edc8&gdpr=0&gdpr_consent=
content-length: 355
date: Fri, 18 Apr 2025 07:41:35 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Ub6ncEdE2uXTck.auZNDM.lHWiicY4E-~A&gdpr=0

0
261 B

441ms
136ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Ub6ncEdE2uXTck.auZNDM.lHWiicY4E-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:36 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Ub6ncEdE2uXTck.auZNDM.lHWiicY4E-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html
server: ATS

GET
H2 200 266DE8B3-0AF0-4E55-A563-C4BF98260BAC
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame FC84 43 B
519 B 148ms
133ms Image
image/gif 2600:1f18:4e9:5a07:201d:c932:a884:778a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/266DE8B3-0AF0-4E55-A563-C4BF98260BAC?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:201d:c932:a884:778a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=bd64ef9f-2711-4c04-9412-b41455b911ac&gdpr=0&gdpr_consent=

1 B
315 B

341ms
129ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=bd64ef9f-2711-4c04-9412-b41455b911ac&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 01:53:40 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: cc17883a-8870-4679-805a-5fc65ecf9ffb
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=bd64ef9f-2711-4c04-9412-b41455b911ac&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=aa9a8ae0-1e34-43fc-82db-afde21cfdf17-6802022f-5553&gdpr=0&gdpr_consent=

42 B
307 B

382ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=aa9a8ae0-1e34-43fc-82db-afde21cfdf17-6802022f-5553&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=aa9a8ae0-1e34-43fc-82db-afde21cfdf17-6802022f-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Fri, 18 Apr 2025 07:41:34 GMT
server: A

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=79e9120f856d0565&is_secure=true&networkId=17100&version=1&nuid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAA66mNHMLTygJkr1cNAQEBAQEBAQCXRtmNHgEBAQEBAQEB&expiration=1745048496&nuid=266DE8B3-0AF0-4E...

42 B
449 B

128ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAA66mNHMLTygJkr1cNAQEBAQEBAQCXRtmNHgEBAQEBAQEB&expiration=1745048496&nuid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:30 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAA66mNHMLTygJkr1cNAQEBAQEBAQCXRtmNHgEBAQEBAQEB&expiration=1745048496&nuid=266DE8B3-0AF0-4E55-A563-C4BF98260BAC&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
pragma: no-cache
server: nginx

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame FC84 0
35 B 412ms
132ms Image
text/plain 35.153.242.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.242.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-242-12.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Fri, 18 Apr 2025 07:41:35 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame FC84
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8670328399276094062&gdpr=0&gdpr_consent=&us_privacy=

1 B
322 B

321ms
126ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8670328399276094062&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8670328399276094062&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Fri, 18 Apr 2025 07:41:30 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame FC84
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_126F45B37_85D79763&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

137ms
137ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-427966896; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Strict-Transport-Security: max-age=-427966896; includeSubDomains
Expires: -1
Cache-Control: no-cache
Content-Length: 43
Pragma: no-cache
Date: Fri, 18 Apr 2025 07:41:35 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:35 GMT
server: nginx

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=5713953459701352546

86 B
1 KB

157ms
156ms

Image
image/png

104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=5713953459701352546
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744962095&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Orq2R8huWiFy1egl9SPyNRm48fsYNh3Ha34rfP%2B7CII%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744962095&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Orq2R8huWiFy1egl9SPyNRm48fsYNh3Ha34rfP%2B7CII%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9322854a5bfc69b2-LAX
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=5713953459701352546
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: eb569489-b5f1-43e1-a588-9084e1e36794
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 36FC 0
923 B 231ms
231ms Script
text/html 103.43.90.114
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.114 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.244; 162.245.206.244; 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: f97f2cf5-a355-472a-93d3-e330a7efc113
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Apr 2025 07:41:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H3 204 AGSKWxWD4L_q5ISj6qQI3VRUnCRNlJRQRZvwBZnicfPHcj0zs8BOucinkrVK_ap6zlQBv_U8xW8mUERD71WEDvCKqYhLT3WdOUi2SKOFrXKka9WLd6XGpywWjdv1b6wDMZkFHFwzI0oOjw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 159ms
158ms XHR
text/html 142.251.40.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWD4L_q5ISj6qQI3VRUnCRNlJRQRZvwBZnicfPHcj0zs8BOucinkrVK_ap6zlQBv_U8xW8mUERD71WEDvCKqYhLT3WdOUi2SKOFrXKka9WLd6XGpywWjdv1b6wDMZkFHFwzI0oOjw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xyIBvymv6C9_DQOEmRcPLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:35 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0JBi-FB_mfUHEAvxcKxv6TjAJnBh5YIlTEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDE0EzPwCy-wAAASE0kHw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xyIBvymv6C9_DQOEmRcPLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 cookie
cm.adform.net/ Frame CE5F 35 B
474 B 724ms
233ms Image
image/gif 37.157.2.14
ADFORM Adform A/S

General

Check archive.org

Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.157.2.14 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

access-control-max-age: 86400
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
DATA 200
OK truncated
/ Frame C7C4 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C7C4 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame C23D 2 KB
843 B 86ms
83ms Document
text/html 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 453e00a64236dafeee9f845f54229009432f0ff3ef196f6c827d2d0bb56e26b9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9322854b6e82979e-LAX
content-encoding: br
content-type: text/html
date: Fri, 18 Apr 2025 07:41:35 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v8M33afXRsjhhYv%2Fio1DJeYusJLihFB8QC1MOmprev3nuSghGYKpUgaaoDvveA7BCX3fdtgkgK3kRWDyEAm6zskbP%2B4s3hp00wMKYaiC%2FlglXUU9sQ5dKZCJx8uB%2BdCJo5rnT%2FfNKb5c6g%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 13F5 466 KB
94 KB 539ms
147ms Script
text/javascript 2600:141b:1c00:37::17d2:5c98
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: qwxz.dmcgrathbuilding.com
URL: https://qwxz.dmcgrathbuilding.com/iqnwhavklwshzjeftfllejiciqbduxRZ09GTWFrRFNvS1Rrd1FUOHI5cUotMjYxOS0yNjcyMjgwOC0wZmY3MDI3Ni0zNjg0LUlRUkY2WUx2Q1pIM2E1cmM5eXps/wzmxdrmu2jg2cg1neinb5n8ijf02gdjyb/dedkeu/i9uu9vahyofve
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:37::17d2:5c98 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 0f0a6f26be4c066c25508390dc94b7f838bcab7bc2e81a8f76ee2d6aea63b6de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "6047601a5aedaae7e97ce092b87b1e11"
Connection: keep-alive
Expires: Fri, 18 Apr 2025 07:56:36 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 96007
Date: Fri, 18 Apr 2025 07:41:36 GMT
Last-Modified: Thu, 17 Apr 2025 05:24:12 GMT
Content-Type: text/javascript

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame 13F5 117 KB
41 KB 425ms
136ms Script
text/javascript 2607:f8b0:4006:80d::2006
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://paint.toys
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 65282
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 13:33:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 13:33:34 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250417/r20110914/elements/html/ Frame 13F5 12 KB
4 KB 135ms
134ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250417/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJ17UH0RfEk_Aeind7VMGL08MNsd1lSeBrm46BqntpFdBePkaTKosRB5_aYekV6WgQY5PxDT6Oa-2M05OJjkIGSLM_EYHBsKyef0moLXbzDV-LvLSoHkdFGOfSVcqMJBFBEh2WHzZtwJsRI6A2DLPMpvCICK8fpjRjaiELqSwBA6BF3o5fXYjUBPWms3PaMo85UMBc50JOIm5gqRgPMRAtHGNDqfLxWuZAOg8j3MzS3XIulN3TnbEq9mLbRbrWfGHQogGZnNPoRhoFz1UJ2Yi8qrTIBg&dbm_d=AKAmf-BJIgjOE9DjJyqqTjyJgGK0a5jWOgvjpnUW50bB6WtIDrE9QqcJ0jSLCyf3Iv3aEQIwvcX1FbinhBLrT-shFf1yfxp-DSfU96mStkO3JUcd-nPcv50ECb6vBeHG_dRWvq_f9lUuJZ3iYXSj_x-xUumWpuWU8oOquR7Po2ueso97kxO6KyEw9IziRZaYQSxfacHStE8COxzX-hoEkwZw2-dT2mUuW59Jhrf6B-Zeilsd6OrcFW9H05MiQtU-sOPRpTB8kVd7sZWhfDT4AFV6RYBtkt0oLy8OgkoBVRWUDetjYrfNAkn1g0QZZqOxLcu6gw_VRsU6UOLxa1bn-w4oHK3nLZiMDCPRjqTf1tuOqC2ios0LlXqUCQAcLqoQDEYki8hSczSyuHQE3qMZGrHpquouU7dNafY8wYWCq0tlfk1GxtbWCMcMKt9c6gPI4pkHO1bKt98XDlWRDOy2VVX7VRL7MSX7dmg8QCsGfIBAaNoc5nbvt6JJ62Jhug6zALmubDR8uNJ9_L9gS0SNA3rBXRGMSZ8f4O0bHFZd0b3XOf0nQy2aOw4R3pfxLqMfCzt1FxGuOtBc8a76aVk8fKthFbAcIJg_6oifMEOJM3KXSwUmXwetcnK_kmvacWvIbv1kFzVr20GK32PmeUyCouIH5XR_a4u2NfVEXMKFPXTH77oWBPzQh4ebVZwFqim1npH0WkLa8MVxy1NZFFbRxmq8t4VC5lI6UntNXXpjT82R191HKkW4fy54GKAdQwoPRClv1vehDG3LzGbqBZy4lWspHSJQh5bCp_IUZBoUIRW0kzxN7wkTCqkbSAVdtt8aMDo6zRdmwUB186R2-5oobt173yZx_1VIfmry7NRv8EEkv-AC_ZwElEzLG31b67CLZJ4Rq0OmoWiC8DFmWPud0go4sUnl-P5NGKWJdgoIkleZt1e_7lCCdOca2-6OejAfQoLfM0uIaBQxRaFDVRPdZ6XhjoWSrik7lvEO-nCyEhfdiGwIMVk1-K4RKK4gCqE0vmavWAmBnlTA16sIOAXhF360V2YKS9soZAHIJMvcqWQ4HggwYycXgIzhYTOxgkUrl_5i3Gr1loELKETeQ-Y7Lk_ejb_TUnLEFE3733c79obo2B46zINx7Uo_loOJGlsw-xkqm3kVrt9kJXd3JxpLQHD2hR-1C8LM_ASWBUGJVg3Ae2rtxKHUPBW7wUORvPm6IH4_1sLo1Xce9G_aufpWLUgv0LMflB-tsxvVLj10ZX6ufBTHK5rc2o2pNTQdeILlVWNp1LAsPaSO4O-ynRSjflhMf2JoFvs37Ckm0G5cBJtxHkfnXBH9iuM2X-9VsAuR63Xf2wjxr2mz3uxzLi2eCg2XmFPu0BvwDmMBIh9mcTWIbQ8d7Gind2crkwbE5P_b4bgkL_gv32nkWnVFj9ixC7qrQJHkFyknoAiBESWKdfO5C4Iev6VK3QwtZbpxM2wNHk8IzWclUkRU6eBI0z6bOJYaW8vqc2nNj1o2voZtuJdw5JRz-RCuzJP3vo97TfUMJnTDqOf4PF54_GAC5MVZamQm2oWS6NHnhWiJIOQO5lRidVmRsr17W53YcojTi1aC3zFJVbowrJLvxW4BFb1ipvjy2G7jr0nvKUxpWKqqbjSMoMk3pyx43cCaljQqzI0KVPqqQJOFG3P1gqKPe3sHY189QojX9UbiCzoy6iNo0GuuF8neEU-JY4NlzX4o7R-iL5v3c4D8cMHOREWV-KcDW0cG7clQ1PGboFzpcBpzAxvsoSXvP25QlICmAPViBFlWpX2af9-YfQjPnNZCcPSptlbo24QXo340ap6oM5ux7bnRFErsmN7in8Cur8kkOA0myiIYpRAk9SngdCPH8k6X8ndN5fcJtzrJ2jiAuCLU_GEYjzVTpms81WhN4vr7yADfPUF1Xk5rfVQ8cCGF2mpKTwKf9JJ5JOeP9u5oUjq6kQaZzPOgAzUX7fYo-Jx3YxnJMSJ84qMcQETF3JsPY5gwfM0uEnWyYeLAJgxDN_-o6ehwmRTiJKiZdI_Vu5KOdlPxIub3o173ucgOlWlElFBJVz6KXIEEl32NQyiv9jLwdZoscERqLAcbaL0uL_-RIAPeR043rQLrBckouaPdx7YYDL0ish2wn4fiupg1ZIzhvy5XCkuksDc7sfvPTZo1WHtmvHrPL6WiaM-ZIqa6wnrNK8_e1DaJYWsE57U1zxywALNXlfiFC_wMnng4JrUrZg30VcA5YPDvp92f0TdXqsvr-QuKCVZIR6Wzw8or0L1ARne37Dn3mMwwpAuMRTueH4WfKSjq6D25JkhaTmMazCWT5mjIy1hxelVeUX4P7zAXFZdkhTQRehvqvI1PLg8-qfOGYL1HbPcym2LS7uIgJw63yTcmopT1_hjEzyJ0h3mNs9-WO1FLo--i-Sx3rohWE3BKao2GZiH_ffrG_xRSFa-C-Pzm-RLgEhMpZRSeN520F1RD0idBQ0e7OvcCVMgzfIlA6JXA9_m-b2uqMu6_O0aTJpxQVUM9R9vYFIDmadzFWkiZaLyYxNpJrDm_9EG_IOC87rimpDWifK27HdczVCa1XX_EUxKcY3w7qrBCfpkUXnv44harmjHtDi6TR9m3leu69bv0bPFPEukKnye39Z2eP7NP9n8Q9orD0Jv0RK1_69CleqwxYuhDrJcd4Xud59Jkgf29kDxrvoePmCBiP8BxrHFKYwfVAdoJPyO6FlbgSR5EWEQuTjxDAcgMXvSXq6OQL1dhgIevhD0JumGO3diwJtuKty486x7Wgo-ODjyl83xkqKAa9L2Jzm-vne1EuOGPJ25-XopCcRc_SWTIlVyytzElWohBais9aK7QqDfXdVqSYt4wwqoBf5cOiYDr3r5KrCd_mnm5DmBPMsDH57ShkWpkbHIPy9lYWJA14xqwiWfAkXwiMCdNMMTesL-kHm3NbNLDWFXbJO8tiB-qiDXIcE5_iVlfcMGH9iwknf87RfNDG8haJKm_pM1MCqAsNG1GwWkazQH13MpQyiebXX9hr41rnjh7-A1VD2Zt4y85Gj494MjlKRkPKsULkoWizQWaxEgb35zOFFzbtGg8P0fccO3_xGJo66DEr8Yw0BkCeRt4T_4TFipJy4jGel-YrRP6jAwhtesd1S2I7BhWikIZAQANabwpIZDqkwCFdFt6dV2B2ifghPVCyZorFEYWODp3tN8T2uDvvF3-UCNaVe2ro6Cqx6DAMmF_GWb1ekTYkaIF4oOivHBCW9QKtRHeAqnLJgNuQLDNR52G5RxKZjaezrOtl6wg0MYi9RHFPgqTBgnzlV9TbgGrVHAEOqdIysjoZ3gOIp30mV1VhAya1PaynCtQ79jeO3Gwf6IHqQyD24qi6L2B8F8f0lAY6urqJRhGOWQorbTm__jy5H9ImIeQWbTrJL8sGLUcVhmetVUEwHKCWLN7aPax9v_xNuWbfhvvavBok_Z0AnBcs1dlGt6DQVPIP-dn2adUdLubcF9RDkJNLjDxyd6Ymv4RP9T62pj2dAv1-3NUX123GgOUqZs9n4-f1ggGTCtof3byKMt9YLy7-4oHPTuTXJvnSn7K_XzBpkpTe7DCnUIyBxmtHnVYmoJJbktrO9q1XV_iZ_MjXtEHbzzrX8O_TKfHvCJOSJzXzRAjrM_JjKA7L41zmHddZxw7tlFrIEer8tikWLJXBQF60TFMKULKeS0DkhBGKT7wn9EI26DcQXRztL9hEaQc7DX1V7VxQfU1SSGriMo_B0WnEH586aClySmZ1lirdL4iACBU3SL4JYQaUsVPuHBO64wzw2tw8qPXnP12sEsrIVwTppwy7a_208HWl9JZR7Ja-x7u250qqXUz&pr=8%3AB3A4C1FB652DECC2&cid=CAQSSQDZpuyznKgKBleYd0QbREWihOE7V4T6qFRMG4pCEghoJcfXrnWuOksmTydbAYfl7_sL8UDVNIhbx2vHSYx8g28gNUvmtC3D1ywYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&ct=76&iif=1&cor=14384139421140020000&adk=4289860714&idt=574&cac=0&dtd=35

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ec0d4a8b73c1b311d91ec21907b35ed43be697059740b70571f5a8abe40a96a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8593911155552589720
age: 63050
x-content-type-options: nosniff
expires: Thu, 01 May 2025 14:10:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 14:10:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 4395
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250417/r20110914/ Frame 13F5 28 KB
11 KB 135ms
134ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250417/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

126bdd7c5d28809ee227043a6517b20f189eb762539a0270a131172de444ab60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 7949669369980903041
age: 63103
x-content-type-options: nosniff
expires: Thu, 01 May 2025 14:09:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 14:09:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10746
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 13F5 41 KB
14 KB 422ms
133ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
age: 1622
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 08:04:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:14:34 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 94AE 269 B
379 B 147ms
146ms Document
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&us_privacy=1NNY&geo=na&co=us
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Fri, 18 Apr 2025 07:41:36 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
0 154ms
154ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
0 152ms
152ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 13F5 0
0 157ms
157ms Fetch
image/gif 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuk_EI6v3L1YmyKS7S0izoVXX8uYiV79ko55ASIyhLbXLETEb65c0lF9lFiKxzGpVjOyl1N4z6vpOTkcqy_sxayFnxV3HKIXMLL1bq0nGeQ97R7OvpfKLoYSawsXnjqPPZTKhAu6sZywSVKi0WzSe_HJXA1jRdgdy_7_1ZcWCtborY0U-bHVBg73k3kTBEdu-KC4Ha_CcmsyQx5HItphN6baUnrj-agqkSFLNspkj8KxGqOrgsLB6cvqUS_8MjZC6HX41UWqM3FEa1aFS1CndKW504xnQZnF4zqnrUTgENkCZXdM0TlZyx3-NxXUG0VEhMfqLEpSFYhNzmeC7RWZdLSlXWBV19GcCLO0qv5mYe1HHRsxVu-cgVrR0QjKKb8kb6XwbpuYhJXSE-ycgjfkg1PWOoUI1j51mgAZ0ckvMMTIYw7HXB5GtJDKLlJ1OZxmQnpF5mGksLVsL0BwQVnEEnN4JNzkiQOpb7zdLsjaRAfe_Ye0lBCyvVKGQpKcpTn-V5-dXQvCkxHpqKbgfaFVVZzE2BfF7dBRaP1JmKXGAFBsN8SalimM2iNIB74ftZtl3iFWBZw0ub4xYQ3TtYZY7EM6JsYX9U&sai=AMfl-YTKvSwwe-BRlYcgCUYxkqqqQxP17vp1vTPwQShKiSOJtoZLEToIdRDBkLWkhS_6jsMPe6TW8L9M8R0UOUVFZXibXnBrOUyJPXPTOl8YECitKb22qv4zAsXvd4s&sig=Cg0ArKJSzJfflMgDwYLDEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 07:41:36 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 13F5 206 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 40d8939eb0107c5723bbca4a1e5431b614df04baa4ae128e14fc0256bf8c850d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C23D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAICL8AoIrYAFRG0AYuQOQAA

170 B
188 B

155ms
154ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAICL8AoIrYAFRG0AYuQOQAA

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pp64DflEGZ1pHWVOts%2BTeN%2BrALaFC97mt54UDH9pAJXI6qfdK4uCB3MkQn1NMnD7PREKXCoJbf%2BXVKEPwHkcsEOFXE5%2FITCYg1ZkJTen2Oks%2BkpCCc07UJp1n2Xw7SOWrMdXNbOgqsapVA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:36 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAICL8AoIrYAFRG0AYuQOQAA
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9322854c7e61525d-LAX
content-length: 0
server: cloudflare

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame C23D 170 B
188 B 154ms
154ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aAICL8AoIrYAFRG0AYuQOQAACjEAAAIB&gdpr_consent=&us_privacy=1NNY&gdpr=&gpp=&gpp_sid=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sync
nlsn.thrtle.com/ Frame C23D
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aAICL8AoIrYAFRG0AYuQOQAA%262609&gpdr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=3e988202-6641-4faf-af22-7fe6c4a61a00&us_privacy=1YN-&us_privacy=1NNY
https://thrtle.com/sync?_reach=1&vxii_pdid=3e988202-6641-4faf-af22-7fe6c4a61a00&vxii_pid=12&vxii_pid1=7006&vxii_rcid=2803cda8-a3f9-46a6-8117-56e2a145b5fc&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=2803cda8-a3f9-46a6-8117-56e2a145b5fc
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=a6f45e70-9fec-4876-9b21-5a0eb157edc8
https://thrtl.redinuid.imrworldwide.com/thrtl?url=https%3A%2F%2Fnlsn.thrtle.com%2Fsync%3Fvxii_pid%3D5036%26vxii_ts%3D2
https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=8f1e42c0-1c28-11f0-ba77-7fd3b53fdae3

43 B
540 B

142ms
135ms

Image
image/gif

35.170.145.216
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=8f1e42c0-1c28-11f0-ba77-7fd3b53fdae3
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 35.170.145.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-170-145-216.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Fri, 18 Apr 2025 07:41:37 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
access-control-allow-origin: *
location: https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=8f1e42c0-1c28-11f0-ba77-7fd3b53fdae3
content-length: 0
date: Fri, 18 Apr 2025 07:41:37 GMT
cross-origin-resource-policy: cross-origin

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C23D
Redirect Chain

https://match.adsrvr.org/track/cmf/casale?us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=a6f45e70-9fec-4876-9b21-5a0eb157edc8&expiration=1747554096&gdpr=0&gdpr_consent=

43 B
762 B

91ms
90ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=a6f45e70-9fec-4876-9b21-5a0eb157edc8&expiration=1747554096&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0UQ6u5Vj8T6GQtUjmYPSfconWNAVIvRt2DL0Knai6AnWSuJrPTxA4mh3zVfdEUhrqmuQksBU0F%2FtX%2FBbMMZRnN2NW38kGqrtBBC3tUkqnty4UDcQLHkhrfZvaldH7g7ErPdpFTf2b2w7QA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9322854d5f02525d-LAX
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=a6f45e70-9fec-4876-9b21-5a0eb157edc8&expiration=1747554096&gdpr=0&gdpr_consent=
content-length: 323
date: Fri, 18 Apr 2025 07:41:36 GMT
server: Kestrel

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame C23D 42 B
181 B 411ms
131ms Image
image/gif 2600:1f18:61c0:2205:3afc:4f47:5e5:e52c
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH&us_privacy=1NNY
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:61c0:2205:3afc:4f47:5e5:e52c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-transform,public,max-age=300,s-maxage=900
content-length: 42
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
vary: Cookie
server: nginx/1.22.1

GET
H3

200

crum
dsum.casalemedia.com/ Frame C23D
Redirect Chain

https://match.deepintent.com/usersync/113?us_privacy=1NNY
https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_4fdad7f8137f4727891a3

43 B
794 B

175ms
92ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_4fdad7f8137f4727891a3
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V7wEWDhejd%2FIsExeWGOu7XR%2BsLf%2FWya2iGyFz%2F5Z4alKgk48Mfso7GWFukmYlAWy5dq9OFoW%2F5DgXdpXcuBwEWCjAF09WQSeREYvk11ushkIF35oQNpNsJMeeleCD86X%2Bfk5Wklp"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9322854e1c1e2b55-LAX
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_4fdad7f8137f4727891a3
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
server: b

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame C23D
Redirect Chain

https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=1NNY&user_id=aAICL8AoIrYAFRG0AYuQOQAA%262609
https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=1NNY&user_id=aAICL8AoIrYAFRG0AYuQOQAA%262609&tc=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=Igu-mpnVigostPf6__uK6FrRvjgOLUNq8sWUF_R33pk&pi=index&gpdr=&gdpr_consent=&us_privacy=1NNY&user_id=aAICL8AoIrYAFRG0AYuQOQAA%262609...

43 B
769 B

100ms
100ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=Igu-mpnVigostPf6__uK6FrRvjgOLUNq8sWUF_R33pk&pi=index&gpdr=&gdpr_consent=&us_privacy=1NNY&user_id=aAICL8AoIrYAFRG0AYuQOQAA%262609&tc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w%2Ba%2Fo1eLNhlbNHnCXYtDmRaXz3v3MPiJamPFFXV%2F6YUEyL70bPHiPynwrlts1pDLBpwj18lV1FNLSDkTSCANhI8%2BW3W5K8gWDgsKJmObF3HPdY65CN%2Bu3kvNnru4pbTpP%2FyRQ0ltrxT8jQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9322854f6872525d-LAX
content-length: 43
server: cloudflare

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=Igu-mpnVigostPf6__uK6FrRvjgOLUNq8sWUF_R33pk&pi=index&gpdr=&gdpr_consent=&us_privacy=1NNY&user_id=aAICL8AoIrYAFRG0AYuQOQAA%262609&tc=1
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT, Fri, 18 Apr 2025 07:41:36 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame C23D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=68&us_privacy=1NNY
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=123&external_user_id=HdhDQKUxXct0ey7No291gqL1zvQ

43 B
767 B

88ms
88ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=123&external_user_id=HdhDQKUxXct0ey7No291gqL1zvQ
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7He2EOADz8cTOnwvtH4d3itOgf8KV5VLIGWgHzjOBnKkW4ojUl%2Bt0Vu4BmpcoldHuzRnGpIMXBPjAoqjbAf%2BMS%2BLF%2F04V8v3JVTAkCi6zwTRCcIaE1WbnyX2OhNJ5dnHqlWZvC%2B81DYj4A%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9322854d8f2c525d-LAX
content-length: 43
server: cloudflare

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=123&external_user_id=HdhDQKUxXct0ey7No291gqL1zvQ
Content-Length: 123
Date: Fri, 18 Apr 2025 07:41:36 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 setuid
prebid.intergient.com/ Frame C23D 0
1 KB 160ms
159ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&us_privacy=1NNY&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aAICL8AoIrYAFRG0AYuQOQAA%262609
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1744962096&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=OdaLYTvTqPQ%2Fwk1B2BOuks1xA%2BPZEK%2Fn5NQGmp4bbuc%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1744962096&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=OdaLYTvTqPQ%2Fwk1B2BOuks1xA%2BPZEK%2Fn5NQGmp4bbuc%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9322854cb9eb7d7a-LAX
server: cloudflare

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
0 153ms
153ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 94AE 43 KB
0 136ms
135ms Script
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&us_privacy=1NNY&geo=na&co=us
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: d5bac0b19c9b62dafe59ea2542333d9716a454baa9e65ce236f076f748d052fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?&us_privacy=1NNY&geo=na&co=us

Response headers

cache-control: max-age=24784
content-encoding: gzip
expires: Fri, 18 Apr 2025 14:34:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11319
date: Fri, 18 Apr 2025 07:41:33 GMT
last-modified: Thu, 17 Apr 2025 14:34:37 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame CE5F
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redir=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpb...
https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT

0
668 B

109ms
109ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93228550e8f169c7-LAX
expires: 0
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT
date: Fri, 18 Apr 2025 07:41:36 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C682 38 KB
13 KB 419ms
135ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 51
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 07:40:45 GMT
expires: Fri, 18 Apr 2025 08:30:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 Blue%20Arc_160x600.html Show response
s0.2mdn.net/sadbundle/15208524878589198336/Blue%20Arc_160x600/ Frame 264C 8 KB
3 KB 413ms
135ms Document
text/html 2607:f8b0:4006:80d::2006
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15208524878589198336/Blue%20Arc_160x600/Blue%20Arc_160x600.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c669c67b9e2e61ac43b79a1e5935ca09b2b3bc25c6129f9ac4f9926b9a6030dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 66751
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2746
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 13:09:05 GMT
expires: Fri, 17 Apr 2026 13:09:05 GMT
last-modified: Thu, 30 Jan 2025 15:38:32 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 13F5 0
0 167ms
167ms Fetch
image/png 142.250.81.230
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssApINRjPoNCjlZvNZ_KAmak8zF9iKgjSp3XCJc-JQR2x2mYbiFJAklrIIuNv04L7pmSufm7N94UgOqRGzseA2evFvVDaPpKH33XjKYrnQwQp1uS2s9GI7cVZGrslAl5UjnUm44qQVixRazqNzXlrT7vIK1DAx5iJE1khviGqQA3RXlb084uE0aJDKWvq2wjv7zuOC6sjTCyi3eDCHauDm29nzjPLBrJ0oZUWEsSY02hJnQqbqDLMFNBtzGgccMY05J5iumn37VRWoivQlHVJ45Ymw1_ArtRIpKek9gaO0osb9sFhN3k7s3DFDRraw-oTLAeyNPCKiBrIBROhY2fRkvq8KlCOzkHSh4W6HE4c2arGCYjTm7UQ6cQquZGmZxPtNt4fUdBgB9JRvBDTkon-PcTi9bS4uO9g5htLs0L1hakP10Xy0KlcuFd-BArXkvwG0lEU37-OCrAHC_19Q8dLs5GVQGmlEfKul8OC_KWvk1YXUALqOHumK9CbiGedFZPANPSn6HCT8iqcp10C5lQqbzb0Bb9JT_sAAlQz7BQfhzPtByYHVrBbltTb9hk5ljgiB5dHEqQW4tmPVx3Kx_6tJ-p9_ebUBBjNAqrqkvlRkt8oDBIf6DaK8tUHvsF6c8HHF1UJgNkSyzHfHiyHxz6jsgwuQ7YeQg21KG4MzilidH02H4rU1OKOPhJQk01hNGYqe1U__29Hq3LPsg4nX-zEx5zcyNYqXPCOmvP5dIqjRkDY_wCkHpzGA6VNiuFYw4tHl60_mz1yN2HIBweLuRbEDVSmwkQdsVDLWPYBdVn93zcyESjYQKwn1OPsRJBB6xF7oPurJX9_-KKI0dXJGGXQsQcMYtT4hcEVLx05tvPDMIV72wR2SXSS6Lex2pyGCEBuNlQXqYBPwJ1Ya1-yvDpRuquFGBB-n-K_jYiDrj14w3Zl7_k3wBMAdGhf_NpgALBHhchrABxNKNpFIs7YpqEMCt0IUaTBaMAHjWUsc6bjaUdrztaVsLg4qL85b4Ew6Jyv88KNE7WZwkqg9TjFxt3YcfqDoiZSBsZp0MI6nHybp98CZwhCuzcF3Lst-HbuXFunaYgKyNJ5RJqLjE4Tej3dvkvoYXjRYJtoejBFurLaUwnVcK5d_0j62JTSX9qD-wBfLpc0eexP7Fn2PKA9X5fc4Kma8G4SE9e9g8RBqoXErF5PiQWy9T-ZzQ_pNzu2SYfs3HkqVOUqMU76FTAjyZ1Mf-M9xr5prZVVn_c5IEKOu8LK9hX5G6B670wiYTOhQCXxcs5scecYl8sVhGpbRJdD2WnzVlh-BEu26eb3Awy-MvxGGFMu3sD_uy37q04VAhZwULddHlZmlybIfXWupQsEHOalcVdguQUe_UZaEhkpCbRwejVOLMzcYLgNu3JHSKVnAJ-JutmbAnYZJvG4tet2buPSF01nXeT3k9GDdfIbTVqWAuPTh3iB0-wrihKH_KwA&sai=AMfl-YRji_XaeJ25PnI2JBW6wdEhAX1GrB3tNcAvUE1Fw1yVSq_Gu5ypNHT7d56mYYeLTxjXm6yNULdHLdDLV_53bGpRehrZNmVSZ3nbo5w1xWtyMiOjwQGmeQpe1QTMWbIt-MuFh-krgoN8iMoDyq_CJobFtGeMBwU7CYgcETlNPymcEySLaypbuBfhhbCa38aBAwWesLu0wO2Xt9B88aBuurvOWx0PV_zbChu2lm0SY-MDuhDVqJfudD_afcOwtL9fiyR6ZOJFWa3SG_jLSWPTOURvdkVw_fzNaP2f45ZXTpKIW2dIRvSGAwR_5_HIwRiarHqveOjP15Oz8ijz&sig=Cg0ArKJSzMriQ8yrm_FWEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9hYWEuY29t&pr=8:B3A4C1FB652DECC2&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=632&cbvp=1&cstd=629&cisv=r20250417.93351&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-content-type-options: nosniff
expires: Fri, 18 Apr 2025 07:41:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"34893032":"0xf54c69ade8f39a2e0000000000000000","34893033":"0xeeb3698fbc33f7fb0000000000000000","34893034":"0x5984e8553dd28ff80000000000000000"},"debug_key":"17554253719300105084","debug_reporting":true,"destination":["https://taxact.com","https://aaa.com","https://debugconversiondomain1.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["73900943"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["9033630"]},"max_event_level_reports":2,"priority":"0","source_event_id":"11879984628223193410"}
server: cafe

GET
H3

200

382696.gif
idsync.rlcdn.com/ Frame 13F5
Redirect Chain

https://b.videoamp.com/d2//480eb156-bd60-49ae-9f33-c77d0afceafb/12467/impression?bwb=2&cp3=P31CX9K&gpp_sid=${GPP_SID}&gpp=${GPP_STRING_123}&pubid=9904073&epid=413182102&eadvid=9033630&ecid=32996521...
https://idsync.rlcdn.com/382696.gif?partner_uid=c9ef9c3a-fae0-46bd-a9dd-a88bf4380436

42 B
60 B

119ms
118ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/382696.gif?partner_uid=c9ef9c3a-fae0-46bd-a9dd-a88bf4380436
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 18 Apr 2025 07:41:37 GMT
content-type: image/gif

Redirect headers

access-control-allow-origin: *
location: https://idsync.rlcdn.com/382696.gif?partner_uid=c9ef9c3a-fae0-46bd-a9dd-a88bf4380436
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
server: Beacon Server
access-control-allow-credentials: true
access-control-allow-headers: Content-Type

GET
H2 200 beacon
tag.researchnow.com/t/ Frame 13F5 42 B
431 B 416ms
133ms Image
image/gif 3.171.139.79
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://tag.researchnow.com/t/beacon?pr=290592&adn=3&ca=32996521&si=9904073&pl=413182102&cr=229565206&did=ADID&ord=1570225161&gdpr=&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-79.jfk52.r.cloudfront.net
Software: Apache/2.4.62 () / PHP/7.2.34
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
age: 1928
via: 1.1 bebfdaf3481b8e276dc3fc8a17fefd66.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Hit from cloudfront
p3p: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'
x-amz-cf-id: zfKpqAOvX4zBxMfa4D1VnNU2236cZeLOBr9ohPGUOQil759aAGK5lw==
date: Fri, 18 Apr 2025 07:09:28 GMT
content-type: image/gif
x-powered-by: PHP/7.2.34
server: Apache/2.4.62 ()
x-amz-cf-pop: JFK52-P8

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
0 155ms
155ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
0 155ms
154ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13F5 0
0 155ms
155ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 18 Apr 2025 07:41:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 13F5 1 KB
1 KB 344ms
145ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?ctx=36659756&cmp=32996521&sid=9904073&plc=413182102&crt=229565206&advid=9033630&adsrv=1&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&unit=160x600&prr=1&turl=https://paint.toys/oil/&aucmp=22175993009&auevent=ABAjH0hrkXG3thKoquq6bjpbw4wS&autt=1&ppid=103&aucrtv=635924711&auorder=1019771042&pltfrm=8&ausite=1995081996404&auxch=8&aufilter1=Insert_SeatID_Here&c1=Insert_SeatID_Here&adid=&app=&dup=&gmnpo=&isdvvid=&supplySource=&tagtype=&aUrlD=0&brid=96&bridua=3&brver=&fcl=1239&fec=143&flt=0&brh=2&vavbkt=&lvvn=28&fcifrms=25&winh=1200&winw=1600&chro=1&noc=16&wouh=1200&wouw=1600&htmlmsging=1&refD=1&scah=1200&scaw=1600&jsver=7656&uid=1744962096714352&fwc=0&srcurlD=0&ttfrms=48&num=6&dvp_isOnHead=0&flvr=1&ver=7656&jsCallback=__verify_callback_1744962096714352&jsTagObjCallback=__tagObject_callback_1744962096714352&ssl=1&m1=96&blkmode=2&ee_dp_rdystreq=interactive&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=109340636837.39743&ee_dp_sukv=109340636837.39743&dvp_tukv=198365744114.61227&ee_dp_tukv=198365744114.61227&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTau%40%3A%3DTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JD&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 076d7858fa9eef5fe91c6d0537fd0fc6b635dd81ef49ab96aa375a3b085f2b63

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 1
Expires: 04/17/2025 07:41:36
Date: Fri, 18 Apr 2025 07:41:36 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 150ms
149ms Fetch
text/plain 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54g3v9101576445za200&_p=1744962090688&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=511358154.1744962092&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAI&_s=2&sid=1744962091&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.dmcgrathbuilding.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=7&tfd=7228
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:820::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 07:41:36 GMT
content-type: text/plain
server: Golfe2

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame CE5F
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D%24%7BUID%7D
https://elb.the-ozone-project.com/setuid?bidder=openx&uid=ee7e58fd-f81d-4a97-96b6-72da873a63b0

0
767 B

102ms
102ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=openx&uid=ee7e58fd-f81d-4a97-96b6-72da873a63b0
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 9322855239dd69c7-LAX
expires: 0
content-length: 0
date: Fri, 18 Apr 2025 07:41:37 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=openx&uid=ee7e58fd-f81d-4a97-96b6-72da873a63b0
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Apr 2025 07:41:35 GMT
vary: Origin

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8457 20 KB
7 KB 135ms
134ms Document
text/html 23.41.168.202
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.202 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-202.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=118540
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Fri, 18 Apr 2025 07:41:36 GMT
expires: Sat, 19 Apr 2025 16:37:16 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 2FdxS2qRQ-iFOYzxiZxuWeXxJrfAXWtXpjqcFR5bXcU.js Show response
pagead2.googlesyndication.com/bg/ Frame C682 54 KB
21 KB 408ms
135ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2FdxS2qRQ-iFOYzxiZxuWeXxJrfAXWtXpjqcFR5bXcU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-202-124-0.compute-1.amazonaws.com

Software

sffe /

Resource Hash

d857714b6a9143e885398cf1899c6e59e5f126b7c05d6b57a63a9c151e5b5dc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 60654
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 14:50:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 14:50:43 GMT
last-modified: Mon, 07 Apr 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21179
x-xss-protection: 0
server: sffe

GET createjs.min.js
code.createjs.com/1.0.0/ Frame 264C 0
0

GET Blue%20Arc_160x600.js
s0.2mdn.net/sadbundle/15208524878589198336/Blue%20Arc_160x600/ Frame 264C 0
0

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 394ms
131ms Image
text/plain 52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

GET
DATA 200
OK truncated Show response
/ Frame 96C6 911 B
911 B Document
text/html

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e8e594776e39f8be15b6dffece84d77457b27ad2943e51e723d06361c6baff3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Content-Type: text/html

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 13F5 0
482 B 455ms
162ms Ping
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCNj92moIJ07dTCpCRbYZBD6G7CV-E_hCb_0udZ50_FcJ_Vomp5AfkOErdah_boCaygeFWwAKqvPUMu_KuSlNf74LAbouKIU3jJaiAylP2JLAXM3kwmILs-d4M3QDlADxzqqTGgTkQVsMW5RUEgIXTkojnVjLQsw0NHzh0UC386yPusf0fu5ra3fCavZqJLQPeRG3EzaL4m2EaG3YyQBFeCljRcxQ&sai=AMfl-YT_SwRMQAlrz2_lBO7L5rJCGuLq56XupKSUrCU9I828J98VrOpiaEO5x-VJHHuOxItIsRXaMvzDQ2SUX54Wa4UjMJ2yLvWdp99nRON8xYDF-EqPTnfpGgOl8aENzBJWWeJK8lSW5kseSZI8JgcVCxWilW7TL2psWhrV6O0XTyPtyJkURAA&sig=Cg0ArKJSzPIoXbQZMDDlEAE&uach_m=%5BUACH%5D&urlfix=1&vt=13&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Fri, 18 Apr 2025 07:41:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame CE5F
Redirect Chain

https://ad.360yield.com/server_match?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dimprovedigital%26gdpr%3D0%26gdpr_consent%3D%26us_privacy...
https://ad.360yield.com/ul_cb/server_match?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dimprovedigital%26gdpr%3D0%26gdpr_consent%3D%26us_p...
https://elb.the-ozone-project.com/setuid?bidder=improvedigital&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=8836de93-a46d-4245-b4e9-c1e96ce2e0c1

0
955 B

101ms
101ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=improvedigital&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=8836de93-a46d-4245-b4e9-c1e96ce2e0c1
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=30f428aa-650e-47d3-8a1d-dcedb29b0c03&linkedin.com=6f4803f8-afa1-4ae2-8ea9-3ec3a105edd1&publisherId=OZONEPLA0001&siteId=3500001145&cb=1744962093115&bidder=ozone
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 932285566d2669c7-LAX
expires: 0
content-length: 0
date: Fri, 18 Apr 2025 07:41:37 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

access-control-allow-origin: *
location: https://elb.the-ozone-project.com/setuid?bidder=improvedigital&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=8836de93-a46d-4245-b4e9-c1e96ce2e0c1
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Fri, 18 Apr 2025 07:41:37 GMT
content-type: text/plain

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 96C6 2 KB
1 KB 432ms
139ms Script
text/javascript 2600:141b:1c00:37::17d2:5c9a
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=2303585&cmp=20250310&plc=31025002&sid=29259&dvregion=0&unit=160x600
Requested by: Host: text
URL: data:text/html,%0A%20%20%20%20%20%20%3Chtml%20style%3D%22margin%3A0%3B%20padding%3A0%3B%20overflow%3Ahidden%3B%22%3E%0A%20%20%20%20%20%20%20%20%3Chead%3E%3C%2Fhead%3E%0A%20%20%20%20%20%20%20%20%3Cbody%20style%3D%22margin%3A0%3B%20padding%3A0%3B%20overflow%3Ahidden%3B%22%3E%0A%20%20%20%20%20%20%20%20%20%20%3Cscript%20type%3D%22text%2Fadtag%22%3E%0A%3Cins%20class%3D'dcmads'%20style%3D'display%3Ainline-block%3Bwidth%3A160px%3Bheight%3A600px'%0A%20%20%20%20data-dcm-placement%3D'N1395.150740DOUBLEVERIFY%2FB9689862.280626343'%0A%20%20%20%20data-dcm-rendering-mode%3D'iframe'%0A%20%20%20%20data-dcm-https-only%0A%20%20%20%20data-dcm-gdpr-applies%3D'gdpr%3D%24%7BGDPR%7D'%0A%20%20%20%20data-dcm-gdpr-consent%3D'gdpr_consent%3D%24%7BGDPR_CONSENT_755%7D'%0A%20%20%20%20data-dcm-addtl-consent%3D'addtl_consent%3D%24%7BADDTL_CONSENT%7D'%0A%20%20%20%20data-dcm-resettable-device-id%3D''%0A%20%20%20%20data-dcm-app-id%3D''%3E%0A%20%20%3Cscript%20src%3D'https%3A%2F%2Fwww.googletagservices.com%2Fdcm%2Fdcmads.js'%3E%3C%2Fscr%2Bipt%3E%0A%3C%2Fins%3E%0A%3C%2Fscript%3E%0A%3Cscript%20language%3D%22javascript%22%20type%3D%22text%2Fjavascript%22%20src%3D%22https%3A%2F%2Fcdn.doubleverify.com%2Fdvbs_src.js%3Fctx%3D2303585%26cmp%3D20250310%26plc%3D31025002%26sid%3D29259%26dvregion%3D0%26unit%3D160x600%22%3E%0A%3C%2Fscript%3E%0A%20%20%20%20%20%20%20%20%3C%2Fbody%3E%0A%20%20%20%20%20%20%3C%2Fhtml%3E
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:37::17d2:5c9a Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 1949a9220e11f07e7e5c6088eb2b3985a73964d579f926cda707f83af11fc0bf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=86400
Content-Encoding: br
ETag: "d0889daac50bf65cd2b9e8012b60165a"
Connection: keep-alive
Expires: Sat, 19 Apr 2025 07:41:37 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 745
Date: Fri, 18 Apr 2025 07:41:37 GMT
Last-Modified: Wed, 05 Mar 2025 09:46:27 GMT
Content-Type: text/javascript

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 61C5 0
412 B 418ms
131ms Document
text/html 50.17.104.50
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.104.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-104-50.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Fri, 18 Apr 2025 07:41:37 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame FC84 0
261 B 402ms
129ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=158326&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Apr 2025 07:41:37 GMT
server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C682 0
20 B 155ms
155ms Image
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BewHrLwICaJ_TKpXfoPMP0su1gQ8AAAAAOAHgBAI&bg=!19Sl1JvNAAZDHFaHYxw7ADQBe5WfOGWV_dZtPomZqKgaysXe_gA0-H_wpE6GBIgTScF8Ysz8kcy4DaX_0gs5mnpCX7ETAgAAAG1SAAAABGgBB34ANSKFDCpORciFe3vJhnhjcRO3VVp7GlKGZYm05MRvu95JqUBYF-li3xCaF64yBSGFIHHQD2noCgBCIAzIlVXnu0dFas-oCsjcWZp-ks74-rykGOMctlHLMkOURD1f73IFZuOQ8bH5TIscADhma0bgD8zuOIpb-3mMVJGTmQJxhZak5ZNWc0L_AuakBYp2uRZkcMC2ewOq2rbpVXKoeTq2tAGzWMm_M4qeOK0st1IwKc0-KAbw9UIGVnIgw7NoV2Z10o9kilB7Z5Kp2J-j27oqaNXl7Zzj3K7m41X621bucphydCcaCtYjtN7__f3FGIapGDsVOnbN-x_dIKTiVa5FSyAnuShJ0m9rBDk-040mUW_Dhhh7obJh9woyuVPttdILWX0Zc2fBBQg3_euX4TuB6vZOFD33t83cu2XqnK6YANEqsPaYixZVMInLKPBt27LwoSGsFv286QuntwUJd_G03TXhwjTSeue65FA_cP6ncE7kWSaIqQW12Jg8xAHmIFXEclXHh7zZeLkYHTscwI0s0f5d-WI9YeH-nh13uvcfV0vCbwpxbV0pJzexZDaL6bLM5DpVtLS-IUp9RU5ByqM_X4UY5zkdL7t5Gk5X64MoEcsyYvJRJB8nyW8UvyeQQbKpf3I3MbK9Qv_GZo7GtYKgAFEUp6GbUz-ZMpejpI2RdYl17s37wUCWF6P8EK9JnPNUmRa2aeAVfEQh3uvk68MrflV4DD6BcUoFx-UHXERnSFgUI43EyAdnob9UDVPFGg5x9QNp5ULFTV_LDokwxsFLsFd60vufXMt38VnTaKsVlW2u2lU28RokZRPuCbiOTL2V6-nGwvknQrCoyVPsenvXjajfIj7DBI-v_-VOJVD4udIcOfBUlxewgAnybxAB8550-pUUsIKwn8TEQU7Mb7QRs-zO_4eCzVf817WPt5j2zApQD1H8AfsA7rnNGsXuO72ZSXypiXwS8d9oXXnCChH9sm2alAlRnBUd8C5zlDoTrQ

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS