paint.toys Open in urlscan Pro
15.197.167.90 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 32318
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1662
content-type: text/html; charset=UTF-8
date: Tue, 22 Apr 2025 06:35:34 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JSE3B1T8XDXBYEQ8A28G916Y

Redirect headers

accept-ranges: bytes
age: 36223
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Tue, 22 Apr 2025 06:35:34 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JSE3B1RHQ0XWW9383CCRCZ2N

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 291ms
60ms Script
application/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 030f016ab0c92c63355070641a8f100acbb3b33f4b57b61b7cf6eae6be28db9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 93431a13dab3447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 19ms
17ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 42347
accept-ranges: bytes
content-length: 1373
x-nf-request-id: 01JSE3B1VZA3DQEHYK5TJD6MNJ
cache-status: "Netlify Edge"; hit
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 20ms
18ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 36223
accept-ranges: bytes
content-length: 1208
x-nf-request-id: 01JSE3B1VZ6N4FAMS1P00NQRA0
cache-status: "Netlify Edge"; hit
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 21ms
19ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 42347
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JSE3B1VZPD8TQ1MH6CNSZ8QT
cache-status: "Netlify Edge"; hit
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 20ms
18ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 37843
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JSE3B1VZ670VAAGK90S895HK
cache-status: "Netlify Edge"; hit
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 18ms
17ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 37843
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JSE3B1X3ABMWD2HERPE3VH7C
cache-status: "Netlify Edge"; hit
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 23ms
22ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 13725
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JSE3B1XE8Z3EF3GRFCX8NET8
cache-status: "Netlify Edge"; hit
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 216ms
31ms Script
application/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f07ad708e5431d21d153c90b83d544679f9c9a464b6fc623456fd3c115ec9068

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 93431a13dab2447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 366 KB
123 KB 196ms
49ms Script
application/javascript 172.253.62.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

20c5787f510ba91f098f817a7552a436aeeb661e0cb0760f5f9ffbb81b190786

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1063:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1063:0"}],}
expires: Tue, 22 Apr 2025 06:35:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1063:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1063:0
content-length: 125249
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 308 KB
109 KB 42ms
41ms Script
application/javascript 172.253.62.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54i1v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

44b0678fa0ff53f34638172c892d93320211991314387c245d077c18c75e17cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1063:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1063:0"}],}
expires: Tue, 22 Apr 2025 06:35:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1063:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1063:0
content-length: 111217
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 106ms
64ms Fetch
text/plain 172.253.62.113
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54i1v9101576445za200&_p=1745303734146&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026&cid=1716206214.1745303734&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745303734&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.lixiuding.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1376
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.62.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bc-in-f113.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 a00a397fe29b50405ffa5e07972fb7922f27e951f886ecc5 Show response
faucetfoot.com/scripts/ 68 KB
25 KB 99ms
37ms Script
text/javascript 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/scripts/a00a397fe29b50405ffa5e07972fb7922f27e951f886ecc5

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

430f4cca481d05fc2c3ae517d83d8a8671390155d4eb9dbe1e7060bf0126b88c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"206ff57baa65cf720a22da9b82df0276ae9e9591bc2ca1a9a63fcea29d4dfee0"
via: fen-hoothoot-us-east1-spot-p3zp.gce-us-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
33 KB 55ms
32ms Script
text/javascript 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

934fa0422c45e7850d95f3d1a41a469adcb50d592880027137f02730267ae6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 831 / 20200 / m202504150101 / config-hash: 17555107238634241944
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 06:35:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34051
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 32ms
31ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 2284
cf-ray: 93431a146b0c447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 411 B
336 B 52ms
51ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b35367386570f17ff5be2b4d3f5a9ef2816b7947869005cfae73ec88dcba460

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"038af8099c70ce8099f11e60671651ea"
age: 878
cf-ray: 93431a149b1b447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:20 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 24ms
24ms Fetch
text/plain 172.253.62.113
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54i1v9102396898za200zb9101576445&_p=1745303734146&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&cid=1716206214.1745303734&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745303734&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.lixiuding.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1745303734146&tfd=1473
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54i1v9101576445za200&tag_exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.62.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bc-in-f113.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 runtime.f78d8905f1617efa83f4.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 23ms
20ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aed279b0a29e774ca22dafc6a078e7582490608c9d18bda1a138ca55d0d5be9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f1a6e4325cdcf59d711cbdc9bbf9de8f"
age: 1489
cf-ray: 93431a150b4e447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.f49d9d120d738f961843.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 461 KB
140 KB 45ms
43ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad7d0d55c693f50a025e443da2f37eaea32dad37cbfe918cde1717f8f33af733

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"2da544a46407e9f6f4d2fc5d5058f814"
age: 2371
cf-ray: 93431a151b5b447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/ 529 KB
167 KB 16ms
15ms Script
text/javascript 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

cdn-185-199-108-133.github.com

Software

cafe /

Resource Hash

31e988de147264b3ff0990eac51ed08398a7346729cbd42b231876431fbb4020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 3850784624983485084
age: 47481
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 17:24:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 21 Apr 2025 17:24:13 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170612
x-xss-protection: 0
server: cafe

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
479 B 2132ms
372ms Image
image/gif 18.238.4.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=ad_300x250_7396850
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.4.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-4-29.phl51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 33475
x-cache: Hit from cloudfront
x-amz-cf-id: 64Jh3LTIPu6fObuvrbx9Vznlmck32GVS76eUhaj3ddt1_KtIyFXwcA==
date: Mon, 21 Apr 2025 21:17:41 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 2a78cba32e1e70413cb851835f0eb89c.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: PHL51-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 559 B
444 B 23ms
23ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 5366
cf-ray: 93431a166c30447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 6E8C 503 B
427 B 165ms
119ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 873
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93431a17190c1705-EWR
content-encoding: br
content-type: text/html
date: Tue, 22 Apr 2025 06:35:34 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame C1AF 503 B
0 165ms
165ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 873
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93431a17190c1705-EWR
content-encoding: br
content-type: text/html
date: Tue, 22 Apr 2025 06:35:34 GMT
hw-country-code: US
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Tue/2/desktop/Chrome/ 585 B
919 B 190ms
65ms XHR
application/json 99.84.188.50
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Tue/2/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.188.50 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-188-50.iad89.r.cloudfront.net
Software: CloudFront /
Resource Hash: 892faefd369fc54ea0dd94d2592f5b277e7578cce5ae4aa5828abbcac67e7056

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 1697
via: 1.1 5beb4c3232a40c8c6a3e48c902092760.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 585
x-amz-cf-id: ypYSsUxB-ghsibomipIR3h7welHwnKh01XWJdO_DaxR2lBLg10jwdg==
date: Tue, 22 Apr 2025 06:07:17 GMT
content-type: application/json
x-amz-cf-pop: IAD89-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 150 KB
39 KB 60ms
23ms Script
application/javascript 104.22.74.216
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.74.216 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4f15e09c19ed5d1538fb87a96fae3c64cf96e6df079c96ad3292fb59fc3f476

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "c294994675718f639fda15fe6f23b9af"
via: 1.1 google
cf-ray: 93431a16ea50c35d-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39791
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/javascript
last-modified: Tue, 22 Apr 2025 05:39:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 358 KB
86 KB 63ms
20ms Script
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3e7cec086c6f1c8c57de8561ce5bb8488e68b27391b0d6e8fb0ee471b9de187f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"4173e93caf83178c49bea9e2ca115e00"
age: 173
via: 1.1 d2cb7631fe0377fd030ab6f92237ce72.cloudfront.net (CloudFront), 1.1 886e3ca81a125ea010a3dc17be7b1800.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: SvDZ72a8iEhJhRoH8I4-pYcujHSYShwdcYbPxm8Hscu5T1V0ihR9Xw==
date: Tue, 22 Apr 2025 06:32:42 GMT
content-type: application/javascript
last-modified: Mon, 21 Apr 2025 17:15:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, IAD89-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
594 B 46ms
14ms Image
image/gif 185.199.108.133
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.108.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: c45f847dee2af275006062f8cc576d8cbc534375
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 4A6B:3FCBAC:98C1DD:BF55DF:67FE3F52
expires: Tue, 22 Apr 2025 06:40:34 GMT
x-cache: HIT
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: image/gif
x-served-by: cache-ewr-kewr1740062-EWR
x-cache-hits: 17
source-age: 156
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1745303735.858047,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 544ms
173ms Script
text/javascript 3.162.3.115
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-115.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 85879
via: 1.1 2080aae7ace369c71819923852e1b17e.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: jx7ip03wZSXSxJqgEgyqjj5ZsarNvUbyzVZfqJh0zHpqwPULlJTz-A==
date: Mon, 21 Apr 2025 06:44:17 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 201 KB
65 KB 98ms
58ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

62636a6f1b41099d625ec676c3d1704dbe7d2fa57fca5e326686c4017b626f82

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EC7tEeNC-M_Nj-JtZX1QVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmJw05BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4uHY9nHOATaBGRNfHWBW0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjUwMTLQMzCJLzAAAJNONAY"
content-security-policy: script-src 'report-sample' 'nonce-EC7tEeNC-M_Nj-JtZX1QVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 init-a.js
dl.edge-aicdn.net/assets/ 0
0 100ms
69ms Fetch
text/javascript 172.67.74.15
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://dl.edge-aicdn.net/assets/init-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 1191093
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AhEkvTwG3nxDc9KM6hJeYWK%2BA7%2BOJnxPnT2b%2FFNQZwieXSYlHsyNm9SdTJKJf19aofbtV89nNTNNPOlzk3EmNhhcg4snpK4q6kIBKg5cmoWpi%2FKpIsh6ysaDuoVLGIY6rZiP"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 08 Apr 2025 12:41:16 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=1996&min_rtt=1384&rtt_var=1352&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3818&recv_bytes=2298&delivery_rate=3074309&cwnd=254&unsent_bytes=0&cid=b90acb48a3bd9603&ts=34&x=0"
x-goog-stored-content-length: 0
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:38:53 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvbEiAP5p-f5DXywU8mtutAy6QwKH8Y1fa_nRKkLbKaONHGJp-_9Nl2PKhTrD6GlbZzwqB5l2s
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 93431a177c4a18f2-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743183533533707
content-length: 0
server: cloudflare

GET
H2 200 config-a.js
storage.ml-cachehost.net/lib/ 0
0 103ms
71ms Fetch
text/javascript 104.26.0.244
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://storage.ml-cachehost.net/lib/config-a.js
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.0.244 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 863852
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WATa1ZSXxsqkzGhxOa%2BLUb1K3R%2FsWQper%2FGkz5%2F5O6gWTdAYl9gJIek5zFEEyoEb4ynVmkGaYvaJ4I9dbTMTJHo71do%2FKEmdRIWSaFHQhGDEM9st6qrMNy45F0Ate7uihKuilWww1i8HFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Sat, 12 Apr 2025 06:54:55 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=2196&min_rtt=1368&rtt_var=1776&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3852&recv_bytes=2246&delivery_rate=3057002&cwnd=254&unsent_bytes=0&cid=a511445f61d09eda&ts=32&x=0"
x-goog-stored-content-length: 0
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/javascript
last-modified: Fri, 28 Mar 2025 17:51:11 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIsdPDpvfQkgu01bak1-X2paee5UoIQPKXKS5UJNpuNErDAnMeEvKzwt3s7sOXIanoRy
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 93431a17795dc47f-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1743184271495855
content-length: 0
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
548 B 98ms
68ms Image
image/gif 172.67.11.120
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.11.120 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 662431
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 93431a177832eda1-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 41ms
19ms Image
image/x-icon 142.251.111.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 42821
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 18:41:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 21 Apr 2025 18:41:53 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 98ms
70ms Image
image/gif 172.67.11.120
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.1418104995352365
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.11.120 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 662431
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 93431a177833eda1-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 70ms
32ms XHR
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 33277
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: U7GOkk_a0yNg4imRyqhm7vBZ5UhIAI39lk6s4njDP6_x59WfbSivzg==
date: Mon, 21 Apr 2025 21:20:59 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 9eb9663aa0ab6878338a33c206789a96.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
828 B 648ms
133ms Script
application/javascript 54.192.51.94
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-94.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1745
via: 1.1 0588a12f9163167120c7c5e825e9110a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: 8IJ5LlMfeLI94-03umEJJq2VaB9Hl4J1PDCcyYaUTKK09N_zlteNnA==
date: Tue, 22 Apr 2025 06:06:30 GMT
content-type: application/javascript
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 25ms
21ms XHR
application/json 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 5090
access-control-allow-credentials: true
via: 1.1 886e3ca81a125ea010a3dc17be7b1800.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: OQoAUekMsb5pLtv6fWZyPDG79rW2MiTV3Lb4swLnIQJgXm87KsQXjg==
date: Tue, 22 Apr 2025 05:10:44 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD89-P3
server: Server

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 69ms
21ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qwxz.lixiuding.com
URL: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Tue, 22 Apr 2025 06:50:35 GMT
accept-ranges: bytes
content-length: 17407
date: Tue, 22 Apr 2025 06:35:35 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 366ms
176ms Script
text/javascript 3.162.3.115
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qwxz.lixiuding.com
URL: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-115.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 82938
via: 1.1 2080aae7ace369c71819923852e1b17e.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: xY06ebDlnoWYr98DaSAoO8yVvhiZ4IYs9ry0GNLqUuF4Y3U91pj_oA==
date: Mon, 21 Apr 2025 07:33:18 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 66ms
24ms Script
text/javascript 172.67.36.110
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&_it=amazon&partner_id=403
Requested by: Host: qwxz.lixiuding.com
URL: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.36.110 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3487
cf-ray: 93431a181acdc344-EWR
x-amz-request-id: 30EK9Z61TNZGEA9D
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: hgLnwtuALsYbskRGCQi5eFt+OlYYgDUV2jzbJWqw5EDqxw8Ai5QVLS0e1drBkyx/l35bJKdneuk=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 54ms
22ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

007036d465b81110214bfc2593974dfd94e31304794dd2e2f0a85adf880cf472

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: hVAoZgiTkLWpvXq83y8r2luLDf/xQbzNhjW7co0VMOfEMyhVsvOrRXGDGKWU9CFV5yEU0Y5MotY=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"e080505431750bcc4447c43d487f9da4"
age: 1122
x-amz-request-id: F0KTYDCRNR04R0T5
cf-ray: 93431a180ed142b9-EWR
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 18 Apr 2025 14:04:56 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 74ms
27ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qwxz.lixiuding.com
URL: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Tue, 22 Apr 2025 06:50:35 GMT
accept-ranges: bytes
content-length: 5252
date: Tue, 22 Apr 2025 06:35:35 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 AGSKWxVhJEJY9TJPW6-FRBH6a-66ixybDHzM4LasCU9hIIPwOPrvNaPxXBEXWBFSwX0nCbw-C5Wjqx5WK5POCL8Fwk45SvQkxCqrWmy2J7Xz9n1uFFL5cMUecGH3p6a4NVS3nAZJhB6q7Q== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 46ms
44ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVhJEJY9TJPW6-FRBH6a-66ixybDHzM4LasCU9hIIPwOPrvNaPxXBEXWBFSwX0nCbw-C5Wjqx5WK5POCL8Fwk45SvQkxCqrWmy2J7Xz9n1uFFL5cMUecGH3p6a4NVS3nAZJhB6q7Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1MzAzNzM1LDQwMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsIlR1ekp3V19jUUJnIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInF3eHoubGl4aXVkaW5nLmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.TuzJwW_cQBg.es5.O/d=1/rs=AJlcJMxJc3Db4Quci92H_jRIPF5Xa3XUpA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-3-166-192-103.phl51.r.cloudfront.net

Software

ESF /

Resource Hash

b327c99a35275ab1bdac7f518d5aa479750555293c3aec33f3ce8e5b6c8d8b38

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-bz53R-RpIp0n6OCI2zJRMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj8tDikmLw0JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GQV4ubY_nHOATaBFa1_lZU0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDUyMDPQMTOILDABXtzN_"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-bz53R-RpIp0n6OCI2zJRMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 49BD 101 KB
28 KB 28ms
13ms Document
text/html 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

sffe /

Resource Hash

190f676ee781e35d2d2a8c07e56b2ca05fe36625bbc7a5cfec2f3a060a45c3e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1581
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28980
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 06:09:14 GMT
expires: Tue, 22 Apr 2025 06:59:14 GMT
last-modified: Mon, 21 Apr 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 572ms
123ms Script
application/javascript 3.166.192.103
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.166.192.103 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 2891
x-cache: Hit from cloudfront
x-amz-cf-id: KqxgPIY-xMhixpMp6-JeQsDYcBYKLSgC4SD6JwovXaedW3GTmfn7qw==
date: Tue, 22 Apr 2025 05:47:25 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 a05c988f1ff5eca0063434427c11a90a.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: PHL51-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 48ms
12ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 299353
x-goog-stored-content-encoding: gzip
expires: Sat, 18 Apr 2026 19:26:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Fri, 18 Apr 2025 19:26:22 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwoPaAQXeFpWmMUUGzN2UOdWiqkz4kw_XtEXDDJ7ekh2Ee6MXuG86p4oePDs4APmaLDSxbZoZTI
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 139ms
110ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 956203c4c7a307cbb7df11906fdb6faf

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 54ms
21ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 89932
cf-ray: 93431a187a154366-EWR
expires: Fri, 25 Apr 2025 06:35:35 GMT
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 66ms
26ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Wed, 23 Apr 2025 06:35:35 GMT
access-control-allow-origin: *
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 6E8C 17 KB
7 KB 20ms
19ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3664
cf-ray: 93431a182a551705-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame C1AF 17 KB
0 15ms
15ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3664
cf-ray: 93431a182a551705-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 22ms
21ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Tue, 22 Apr 2025 06:50:35 GMT
accept-ranges: bytes
content-length: 17042
date: Tue, 22 Apr 2025 06:35:35 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 AGSKWxWdhiQY00mleGKizCtMh8c4kHI-xJRMOfNffxuJpHGzlzh6qfszCOFBsxns4iuIq9hTnqZPahGCCCPPWpaDfHzM57XYAorKH9biuCdrG0EfUMt1QO5IJ0Zrd2oiijPhW9Jo3ykbDQ== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 51ms
49ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWdhiQY00mleGKizCtMh8c4kHI-xJRMOfNffxuJpHGzlzh6qfszCOFBsxns4iuIq9hTnqZPahGCCCPPWpaDfHzM57XYAorKH9biuCdrG0EfUMt1QO5IJ0Zrd2oiijPhW9Jo3ykbDQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1MzAzNzM1LDE0MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiVHV6SndXX2NRQmciXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXd4ei5saXhpdWRpbmcuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cd59228915683e87141994d8c147ab4122aae7103f74711403a5d3ec231f5479

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gZ5cNHbDkdAAV2x8ESzumw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmII1pBiOHHrNtMFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkFeLm2P5xzgE2gR0rv4YoaSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRqYGBnoGZjEFxgAAOnPOPU"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gZ5cNHbDkdAAV2x8ESzumw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET 7b872ccf-6804-49d3-be23-b3ac764551f2
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 115ms
64ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 22 Apr 2025 06:35:34 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 159839
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 60ms
23ms XHR
application/json 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 61184
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745178644&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DEdM5RK3UBQQ0DW50HvxrsVaOuAktgYBhGlCxnocuJ0%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Sun, 20 Apr 2025 19:50:44 GMT
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745178644&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DEdM5RK3UBQQ0DW50HvxrsVaOuAktgYBhGlCxnocuJ0%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 93431a190d398172-EWR
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
1 KB 27ms
26ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 2867
cf-ray: 93431a18ddab447a-EWR
alt-svc: h3=":443"; ma=86400
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:08 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 109ms
20ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.lixiuding.com
URL: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 2c230a67b2b755846407c1bde61fc57f2658c6841e753bcb682e3b99a4c8b948

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 446 KB
141 KB 98ms
50ms Script
text/javascript 142.251.111.95
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.95 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f95.1e100.net

Software

cafe /

Resource Hash

d5bb16a3ad6bc51c156beb569a59bf98c4731384c3ac9b171825d89f7ae156ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 9288838900447029510
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 06:35:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144249
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 387ms
183ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-84-72-103.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
854 B 113ms
59ms Fetch
application/json 44.198.22.46
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.198.22.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-198-22-46.compute-1.amazonaws.com
Software: /
Resource Hash: 82c22b66ddc144bd34f3f618908253b492ec54b0ff894ccdf744d4c5eb090752

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
683 B 121ms
68ms Fetch
application/javascript 52.3.206.124
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.206.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-206-124.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 3cb69d44d54d68d89b0f45f51d25250dae427edd2259ae4c9442420f6d1ec2f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 62ms
28ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: a55a5b5ca26d57b697a4aa500ef3fd7d6d4ad77e3cdaaef5c0733b2af2a53dc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1677
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 520 B
933 B 117ms
73ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jse3b2wmp0emy3n46wyh2e4s&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ca91f7d34cb9a03792428cbce4a58490ee508f2d3229be955fc510523b6c1aae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: eec94bf1441f7da5
request-time: 11
access-control-allow-credentials: true
expires: Wed, 23 Apr 2025 06:35:35 GMT
access-control-allow-origin: https://paint.toys
content-length: 520
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 362 B
941 B 103ms
52ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e1aaa4659fe9c1d63c3b053f9cdd99c39519845f5dcd25249f563f51b4c2b79c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 492358
expires: 0
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 1 KB
814 B 349ms
225ms Fetch
application/json 54.192.49.66
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.lixiuding.com%2F&pid=zTKbWNh8taCHB&cb=0&ws=1600x1200&v=25.414.1933&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=94e45d76-e3ba-4119-9589-9a882f4ed446&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D&vm=%7B%22ids%22%3A%7B%22pubcommon%22%3A%228b7af7ac-6ac9-40ee-ba0f-84bc930a3544%22%7D%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.49.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-49-66.yul62.r.cloudfront.net
Software: Server /
Resource Hash: 98dd9bf6191af54f138247c281ae22d2dbed5f30d7ddedbc34e5e3cef8bb79ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 9ea08c3a2524e99d2bb42ac613eb89a2.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 483
x-amz-cf-id: 9H4YJVCwBakw2pQVuqKy5qgvBqx612p8TGlhCWAOiNbwWBjXX0Bqig==
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: YUL62-C2
server: Server

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 55ms
24ms Script
application/javascript 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6192d7b9a03dc98c0490251dfd8f4f7b767bfb4c2726977fc3019a6635bdf342

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 104
cross-origin-resource-policy: cross-origin
cf-ray: 93431a19cc847864-EWR
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Tue, 22 Apr 2025 06:25:44 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 120 B
273 B 27ms
25ms XHR
application/json 172.67.23.234
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.23.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e94408849cc328c6375fcc9c964971824cc173668b844b828b80a6142a534ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 93431a1a3de241d3-EWR
access-control-allow-origin: *
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 99ms
67ms Preflight
text/plain 172.67.23.234
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.23.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 93431a19cd9d41d3-EWR
content-length: 0
content-type: text/plain
date: Tue, 22 Apr 2025 06:35:35 GMT
expires: Wed, 22 Apr 2026 06:35:35 GMT
server: cloudflare

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_33327693-0567-486d-af94-77b4819959e2_1745303735137
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfMzMzMjc2OTMtMDU2Ny00ODZkLWFmOTQtNzdiNDgxOTk1OWUyXzE3NDUzMDM3MzUxMzcQABoNCLfxnMAGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=d0760ebcc15e9ea9928a421203f97d9910de23d0de11bbd0ebe69150bf0eae01791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=d0760ebcc15e9ea9928a421203f97d9910de23d0de11bbd0ebe69150bf0eae01791426b5417dce21&rand=09089298
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=d0760ebcc15e9ea9928a421203f97d9910de23d0de11bbd0ebe69150bf0eae01791426b5417dce21&rand=09089298&expected_cookie=77a7258e-881f-46a8-a530-256971fe235e

0
144 B

33ms
33ms

Image
text/plain

150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=d0760ebcc15e9ea9928a421203f97d9910de23d0de11bbd0ebe69150bf0eae01791426b5417dce21&rand=09089298&expected_cookie=77a7258e-881f-46a8-a530-256971fe235e
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 4357A2F90BA54EA08B81DCFC726C5C75 Ref B: TEB31EDGE0311 Ref C: 2025-04-22T06:35:35Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzWDEw9THaoUDf5gdj6A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 22 Apr 2025 06:35:35 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: /db_sync?pid=10339&puuid=d0760ebcc15e9ea9928a421203f97d9910de23d0de11bbd0ebe69150bf0eae01791426b5417dce21&rand=09089298&expected_cookie=77a7258e-881f-46a8-a530-256971fe235e
x-msedge-ref: Ref A: 734F12BF5CAF46538DA7F14C79A7C81C Ref B: TEB31EDGE0311 Ref C: 2025-04-22T06:35:35Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzWDEwF62n8fg6MgrYng==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 22 Apr 2025 06:35:35 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_33327693-0567-486d-af94-77b4819959e2_1745303735137
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_33327693-0567-486d-af94-77b4819959e2_1745303735137

1 KB
2 KB

23ms
22ms

Script
application/javascript

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_33327693-0567-486d-af94-77b4819959e2_1745303735137
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: 7ffa3f7abb316327c2cd43d74c8d74b97e0cb65d8b28aec24f12906aa70caefb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 22 Apr 2025 06:35:35 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_33327693-0567-486d-af94-77b4819959e2_1745303735137
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 22 Apr 2025 06:35:35 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 3EDE 16 KB
6 KB 60ms
27ms Document
text/html 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 06:35:34 GMT
server: Kestrel
server-processing-duration-in-ticks: 288709
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 171ms
67ms XHR
application/json 205.180.85.210
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 205.180.85.210 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad06-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Tue, 22 Apr 2025 07:05:35 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Origin
server: nginx

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 193ms
130ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 23c7d14fdbbe745b134f3706e0c9ce8bf021d1089c46ce3254716709b0dede99

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
x-cloud-trace-context: 90e90606d9af829ae36514d4c239dbce
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 153ms
58ms XHR
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 160ms
63ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 15B1 2 KB
1 KB 80ms
26ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=34267
content-encoding: gzip
content-length: 859
content-type: text/html
date: Tue, 22 Apr 2025 06:35:35 GMT
expires: Tue, 22 Apr 2025 16:06:42 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame DFA9 1 KB
2 KB 66ms
14ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:29:34 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2Vwr_7cncgxs71J1f5Bpc2sY6EfbKMDyzBbynZcn7pkmw_GblDsCUALirsfFs2fnbFgN2

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 155ms
51ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2bd63d852c64a2ab90cf39aa429984ffef3f25125a4b624e1cd147a6275d86b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745303735&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=gtzYOk6W4za7fUwFuwWqGle9uA9Pb6oiUxux8V4VHfg%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745303735&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=gtzYOk6W4za7fUwFuwWqGle9uA9Pb6oiUxux8V4VHfg%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 93431a1a9e72437e-EWR
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 96 KB
24 KB 396ms
301ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e23e624dfc9a591814ad76b91b69845e6b330fb36b86be1c1c2f206b93c5cbaf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745303735&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=gtzYOk6W4za7fUwFuwWqGle9uA9Pb6oiUxux8V4VHfg%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745303735&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=gtzYOk6W4za7fUwFuwWqGle9uA9Pb6oiUxux8V4VHfg%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 93431a1a8e71437e-EWR
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 428 B
640 B 187ms
110ms Fetch
application/json 3.81.88.244
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.88.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

257038bfa1975b698ca7b14221f80cff21654bf756e0de3b3f3597cd19679805

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 284
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 619 B
784 B 238ms
164ms Fetch
application/json 3.81.88.244
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.88.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e0adddec7417d44e73234d949b9e8a53af8b89150a3213693a1ec22c19154271

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 428
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 24 KB
11 KB 184ms
114ms Fetch
application/json 3.81.88.244
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.88.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

07eb75567fcf7ef0db307bf2c0ffc682c674385f54c8034eed0c1c9913f05b9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 10799
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 24 KB
11 KB 178ms
107ms Fetch
application/json 3.81.88.244
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.88.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-192-42-219.compute-1.amazonaws.com

Software

Resource Hash

3f42739dbbac199ade1ee4ca54e0a5d3cde23a8382a7fa8e4d6f83ae7fcdaf73

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 10775
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
623 B 719ms
126ms Fetch
application/json 18.238.4.18
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.4.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-4-18.phl51.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 15328d8da055d6a81e00918734e2dfce801e30022a5afba7e3c2f8924ccddffc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 e887b311f5a4e2b9f32ce96feeb041ca.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: 8b7b4VvZvn8mDZbEpghpS1eTbt8b4jDvlPhIaBKFOYsh71syYNWjQA==
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/json
x-amz-cf-pop: PHL51-P1
server: istio-envoy
x-reason: domainList is blacklisted
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 34 B
320 B 101ms
63ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0e6c156264263c4eeb871290baeec4a853e1989a3db4c75d32413139b9dedd2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:35 GMT
server: nginx

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 388ms
324ms Fetch 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Tue, 22 Apr 2025 06:35:35 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 200
OK 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 66 KB
36 KB 409ms
348ms Fetch
application/json 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 87b487dea3a664029ed35633d6d6df89b5e3361c0467961d696c82e8434674bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

transfer-encoding: chunked
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 251ms
191ms Fetch 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Tue, 22 Apr 2025 06:35:35 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 227ms
167ms Fetch 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Tue, 22 Apr 2025 06:35:35 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 112ms
66ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 333e6796670624df3facd6bf28f477c98753056692f80662243c8d691f248da7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 151.243.141.142
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: text/plain
vary: Origin

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 195ms
141ms Fetch
application/json 34.192.42.219
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.192.42.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 21 KB
8 KB 194ms
175ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b184c75c083b5de7901637a99af9aee16742c20d79747318539a22fa00a1de7f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Tjo7n7rnIBjVD4QbGSRn%2F3NvNobwKNeb5X2jMs%2FdK2yf64%2BjRxhRL8rNoWdsjhe16Ms2L2GGt0B0X4pLDXENncX7y%2BTBoStgEQrE%2B6uldP%2FLTmpagCr2xCHBFelluh2VBVT8leg"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93431a1a38c941ff-EWR
access-control-allow-origin: https://paint.toys
content-length: 7165
server: cloudflare

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 687 B
1 KB 145ms
94ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544%5E1%5E%5E%5E%5E%5E&eid_33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=44c4c1b4-4aa7-4405-ae44-bb5e355031bc&l_pb_bid_id=98f6c2c683d52148&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=1cbffd91-01c8-4933-a200-6e66d57abd0e&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.792004274761298
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 10d00d8fdceeb96572603b1e67b36b244ea9cc70ad0adb50eb5e15ca3a1f5163

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 519 B
860 B 150ms
100ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544%5E1%5E%5E%5E%5E%5E&eid_33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=44c4c1b4-4aa7-4405-ae44-bb5e355031bc&l_pb_bid_id=999cf174b96df1d8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=3c2dc80a-7fd6-4ea0-9033-874ae5e5626c&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.7330619855368431
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: b3856099499f7b37430ff32989216276561dff2c51a6273929dbd5dfd462a633

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 519
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 525 B
866 B 75ms
25ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544%5E1%5E%5E%5E%5E%5E&eid_33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=44c4c1b4-4aa7-4405-ae44-bb5e355031bc&l_pb_bid_id=1000f74c0ca8e8f98&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=3d8b6ace-d1b5-4325-8589-e567f74320ca&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.9088363171331234
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 8a24a88fe7aa3571a8e8e32f063088f1ff62836bb076843167f120552ccced54

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 525
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 525 B
1 KB 68ms
18ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544%5E1%5E%5E%5E%5E%5E&eid_33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=44c4c1b4-4aa7-4405-ae44-bb5e355031bc&l_pb_bid_id=1018e74f63be2171&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=8517b3db-f8ef-403a-8141-4cdfbb3c0eb8&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.3558758534964842
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: afd52b6de24842dda952ead8d3675d081655063f36f7b06af19a9cb9e5d2bc50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 525
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 153ms
63ms Fetch
application/json 34.192.127.112
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745303735376&to=600&aun=pw-160x600_atf&pubcid=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33acrossId=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=1cbffd91-01c8-4933-a200-6e66d57abd0e&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.127.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-127-112.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 153ms
63ms Fetch
application/json 34.192.127.112
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745303735377&to=600&aun=pw-160x600_btf&pubcid=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33acrossId=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=3c2dc80a-7fd6-4ea0-9033-874ae5e5626c&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.127.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-127-112.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 153ms
64ms Fetch
application/json 34.192.127.112
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745303735377&to=600&aun=leaderboard_atf&pubcid=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33acrossId=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=3d8b6ace-d1b5-4325-8589-e567f74320ca&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.127.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-127-112.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 153ms
64ms Fetch
application/json 34.192.127.112
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745303735377&to=600&aun=leaderboard_btf&pubcid=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33acrossId=null.0014000001YrMoYAAV.1041.cgyW7tB3%2BJhufhfPmu%2FbYSykFVJRLq%2B8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG%2BlkJi%2BdhT%2BiCAGcS96st3zRo6%2BviKXIZ%2Fg%2Bze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K%2FjhGMSCE26EnwDia%2BaBq%2BLJgymRgrEL1P7n6mZ9FVlYOBN1k%2FFxIxQXBE5J8L%2FZugJNpnwtzpKtV%2FJQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38%2FVy%2FQHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D%2BvRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf%2BXAjMoWvG0biM8QmuqIfq1adi%2FoqHEsnlHuUWMgWBM0H0EsNysm%2FyjMCY%2BM8R0f8cC5VHOUk9G7P%2FupqN7pWg5%2Bkq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg%2BrBsbcYYbD9f%2BBCT1UAhHBmQmb220vNEYTHaoki%2BMnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX%2Fj7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH%2B6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY%2BPoyUwQEP0jgaFOVol0IhZt6A%2FZAeU4SDmdJmkD3mOHKKWM6wlJrdx%2FSWYETH%2BKjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ%2FS2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi%2FjPDEys6LTbuIDusSbdwNqZprQfjXT33yuI%2BqTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt%2FLP9QmkSglGeW7DA7U4Lt4VWr%2BfjrWzPJTtyuHLegmSzNDvU%2FFQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c%2FefMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W%2Fhrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6%2FTXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19%2BhIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=8517b3db-f8ef-403a-8141-4cdfbb3c0eb8&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.127.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-127-112.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 26 B
322 B 139ms
89ms Fetch
application/json 74.119.117.5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

80c632d27e4eed7d53085cdae6618d3562b5f2522a7e1ffb111e7ee2e937d2a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 144 B
1010 B 150ms
113ms Fetch
application/json 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd2a591d3d353bfc4a3e645203fc18203fb713d613c51b511d92aa1a3667f5a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93431a1a693da4c6-EWR
expires: 0
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 485 B
2 KB 164ms
126ms Fetch
application/json 68.67.181.103
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

6c23bc5a53590a2e7f80e9ab737badda39b1b72a0e2c0d315d3f98274cfa51ea

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 3906b798-204b-4103-9e92-3e297d59e860
content-length: 485
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:35 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 111ms
59ms Fetch 74.119.117.12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=95789881709&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 57ms
17ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 3EDE 425 B
937 B 16ms
14ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b3b4ab028a9d87ab240483c0e356c3b83d3addcd7f0bcc5fd6e6f9220223f0f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1255150
expires: 0
date: Tue, 22 Apr 2025 06:35:34 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
444 B 37ms
29ms XHR
application/json 44.198.22.46
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.198.22.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-198-22-46.compute-1.amazonaws.com
Software: /
Resource Hash: 8086f4c9ead0ea62395de8472e135bd4ed50b713a4adb202ac8e614c4ba80dd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=utf-8

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
564 B 87ms
81ms XHR
application/json 44.198.22.46
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.198.22.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-198-22-46.compute-1.amazonaws.com
Software: /
Resource Hash: 6514a6a31db723dc239b32b50fc9667ad4df7110cb097eaa7b53a693837ea0ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=utf-8

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 22ms
22ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Tue, 22 Apr 2025 06:50:35 GMT
accept-ranges: bytes
content-length: 67550
date: Tue, 22 Apr 2025 06:35:35 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&bid=1e2n4ou

70 B
440 B

18ms
16ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 22 Apr 2025 06:35:35 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&bid=1e2n4ou
content-length: 191
date: Tue, 22 Apr 2025 06:35:35 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MmJfQmJRTDVWN3ZRUFNCLURYZ3Rpc21hb1hqQnhKV2RmNWlCRTV2QS1hM0k&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MmJfQmJRTDVWN3ZRUFNCLURYZ3Rpc21hb1hqQnhKV2RmNWlCRTV2QS1hM0k&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEBGr6CtFa_ex6gU_kzcwCT4&google_cver=1

70 B
440 B

240ms
240ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEBGr6CtFa_ex6gU_kzcwCT4&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 22 Apr 2025 06:35:35 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEBGr6CtFa_ex6gU_kzcwCT4&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Tue, 22 Apr 2025 06:35:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-uUjk8ThE2pVRjc_TJzD5DvNT39mMbTV4ibc-~A&gdpr=0

70 B
440 B

161ms
17ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-uUjk8ThE2pVRjc_TJzD5DvNT39mMbTV4ibc-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 22 Apr 2025 06:35:35 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-uUjk8ThE2pVRjc_TJzD5DvNT39mMbTV4ibc-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3128279717856594852&newuser=1&referrer_pid=m51mh00

70 B
440 B

18ms
17ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3128279717856594852&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 22 Apr 2025 06:35:35 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3128279717856594852&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Tue, 22 Apr 2025 06:35:30 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=847465635067354972&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

17ms
17ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=847465635067354972&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 22 Apr 2025 06:35:35 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=847465635067354972&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ef26124f-a94e-4c1b-85dc-2be774c8933b
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
705 B 52ms
18ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 81a6628fc14122b78f0bc6e360efb603a62e65046c190620b4881802586effe8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 56ms
23ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 22ms
19ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 25ms
24ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 187ms
60ms XHR
application/octet-stream 100.27.136.39
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.27.136.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-27-136-39.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame F351 0
412 B 123ms
59ms Document
text/html 54.146.6.218
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.6.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-6-218.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Tue, 22 Apr 2025 06:35:35 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/ 64 KB
23 KB 18ms
14ms Other
text/plain 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4a1f6bb4df43a4e3aded46465e55b8749b64817d13ed9557075c596d218c340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5790688912801242087
age: 59668
x-content-type-options: nosniff
expires: Mon, 28 Apr 2025 14:01:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 21 Apr 2025 14:01:07 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23384
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504170101"

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 208ms
205ms Fetch
text/plain 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 584ms
390ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

2bd667d706761b84f9c5d73303d446500668a69bbc3c758904347adc17f79f98

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 1040ms
460ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

2bd667d706761b84f9c5d73303d446500668a69bbc3c758904347adc17f79f98

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 53ms
19ms Script
application/javascript 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e3f84b2a779d78921849c67d98e91ee507be4fe504fc609bb4293bce0e5910e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 281
cf-ray: 93431a1bd8ef5f83-EWR
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Tue, 22 Apr 2025 06:26:00 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
95 B 362ms
332ms Image
image/gif 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&halo_id=060ixedju6a65d68ch89bhaibedlbffdlifuomkwi0e0yk04is46gseugmk0gook0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1bdf0fae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 423ms
223ms Image
text/html 44.239.163.177
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.239.163.177 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-163-177.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&adnxs_id=4161161628424474210&gdpr=0

43 B
170 B

342ms
330ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&adnxs_id=4161161628424474210&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1bdf17ae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&adnxs_id=4161161628424474210&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: f57d61b3-5217-4a2b-8e6e-582f6c63fdd1
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001745303736-95UXXHDU-H3QW%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001745303736-95UXXHDU-H3QW%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=329fa750-4d42-4689-86c3-7a9fc5f9bd76&id=AU1D-0100-001745303736-95UXXHDU-H3QW&auid=AU1D-0100-001745303736-95UXXHDU-H3QW

43 B
95 B

371ms
371ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=329fa750-4d42-4689-86c3-7a9fc5f9bd76&id=AU1D-0100-001745303736-95UXXHDU-H3QW&auid=AU1D-0100-001745303736-95UXXHDU-H3QW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1e19b8ae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=329fa750-4d42-4689-86c3-7a9fc5f9bd76&id=AU1D-0100-001745303736-95UXXHDU-H3QW&auid=AU1D-0100-001745303736-95UXXHDU-H3QW
pragma: no-cache
x-forwarded-for: 151.243.141.142
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001745303736-95UXXHDU-H3QW
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001745303736-95UXXHDU-H3QW
https://ids.ad.gt/api/v1/pbm_match?pbm=04786EE4-3EF3-41F1-966F-7BE00608AD0E&id=AU1D-0100-001745303736-95UXXHDU-H3QW

43 B
118 B

169ms
169ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=04786EE4-3EF3-41F1-966F-7BE00608AD0E&id=AU1D-0100-001745303736-95UXXHDU-H3QW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1e19b9ae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=04786EE4-3EF3-41F1-966F-7BE00608AD0E&id=AU1D-0100-001745303736-95UXXHDU-H3QW
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:35 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001745303736-95UXXHDU-H3QW&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&rub=M9S4S51Q-1T-6N4R&gdpr=0

43 B
95 B

158ms
153ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&rub=M9S4S51Q-1T-6N4R&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1e29bdae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&rub=M9S4S51Q-1T-6N4R&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: cdd55fb02049ca8b9389527f6c1a1194
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001745303736-95UXXHDU-H3QW&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&id=AU1D-0100-001745303736-95UXXHDU-H3QW

43 B
95 B

210ms
208ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&id=AU1D-0100-001745303736-95UXXHDU-H3QW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1c9fe8ae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&id=AU1D-0100-001745303736-95UXXHDU-H3QW
content-length: 259
date: Tue, 22 Apr 2025 06:35:35 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001745303736-95UXXHDU-H3QW&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001745303736...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001745303736-95UXXHDU-H3QW&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001745...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=5a17035e-9b2f-42fa-8259-08dde360eba0%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&ttd_puid=5a17035e-9b2f-42fa-8259-08dde360eba0%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&tapad_id=5a17035e-9b2f-42fa-8259-08dde360eba0

43 B
95 B

324ms
324ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&tapad_id=5a17035e-9b2f-42fa-8259-08dde360eba0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a209ce7ae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&tapad_id=5a17035e-9b2f-42fa-8259-08dde360eba0
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
server: Jetty(11.0.25)

GET
H3 200 pixel
cm.g.doubleclick.net/ 170 B
188 B 32ms
31ms Image
image/png 142.251.179.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001745303736-95UXXHDU-H3QW

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:35 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001745303736-95UXXHDU-H3QW
https://ids.ad.gt/api/v1/amo_match?turn_id=7939453724685623541&id=AU1D-0100-001745303736-95UXXHDU-H3QW

43 B
94 B

337ms
333ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=7939453724685623541&id=AU1D-0100-001745303736-95UXXHDU-H3QW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1bdf15ae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=7939453724685623541&id=AU1D-0100-001745303736-95UXXHDU-H3QW
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Tue, 22 Apr 2025 06:35:32 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&uid=2acab417-f039-4b41-9fbf-a02a658fb7c0&gdpr=0

43 B
94 B

111ms
111ms

Image
image/gif

104.22.5.69
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&uid=2acab417-f039-4b41-9fbf-a02a658fb7c0&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1e8a2eae20-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745303736-95UXXHDU-H3QW&uid=2acab417-f039-4b41-9fbf-a02a658fb7c0&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Tue, 22 Apr 2025 06:35:36 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-14
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001745303736-95UXXHDU-H3QW
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTMwMzczNi05NVVYWEhEVS1IM1FX

170 B
188 B

25ms
25ms

Image
image/png

142.251.179.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTMwMzczNi05NVVYWEhEVS1IM1FX

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.179.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 93431a1e19bcae20-EWR
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTMwMzczNi05NVVYWEhEVS1IM1FX
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 26ms
25ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=5299629a-c3bb-47bf-8f29-629b324bc7a8&ccsid=ae1e3eb8-3a17-4382-bb83-361b86e80961
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 14 KB
4 KB 29ms
29ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: eaa7e3d32d237bf9271ddb57b4068ec273bea7ce8efcf3b3eb36f3b6b5b31206

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 320 KB
112 KB 29ms
28ms Script
application/javascript 172.253.62.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

5827fda59598ac40cdaeda802d2dd6efa5c5aa793019823bea26fb243ccc4e5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1063:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1063:0"}],}
expires: Tue, 22 Apr 2025 06:35:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1063:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1063:0
content-length: 114194
x-xss-protection: 0
server: Google Tag Manager

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 126ms
95ms Preflight 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 93431a1c4c870c84-EWR
date: Tue, 22 Apr 2025 06:35:35 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
89 B 213ms
212ms XHR
text/plain 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1c0f1f7864-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:35 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 160ms
118ms Script
text/plain 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93431a1e4a4bc5e7-EWR
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 481 B
235 B 100ms
98ms XHR
application/json 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92993072f2f5a84f44a639e954fb25e79cbe8a270ba51e5c5dc0aade51e9a34b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 93431a1cdcc70c84-EWR
access-control-allow-origin: *
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

GET
H2 200 j Show response
rp.liadm.com/ 13 B
380 B 325ms
65ms Fetch
application/json 18.211.91.147
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp.liadm.com/j?dtstmp=1745303735692&did=did-0046&se=e30&duid=8e413bd09c43--01jse3b2wmp0emy3n46wyh2e4s&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.lixiuding.com%2F&cd=.paint.toys
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.91.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-91-147.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 5bd4db0f-9fe4-43ea-b48e-b35c7f243176
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 13
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame C43A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%2...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_conse...

2 KB
1 KB

34ms
33ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d94cf0fb30e0950a49473424d56c377e01b9f2af694dbdb7de6547bb04b6cb86

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93431a1c9a732394-EWR
content-encoding: br
content-type: text/html
date: Tue, 22 Apr 2025 06:35:35 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s9fE0XDYaEnTHltzsnnHHA0gXDkKRkuUwTDNugauCQtMU%2B2YZymlsQxbGnJFZak89lIGzyBzEVfZBkH%2FafE8qzi4VlhidB1LGK9NksHVMu7kzo0agou%2F8FEENIG1M2urXX36cT6ZdDAmyg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93431a1c6a4a2394-EWR
content-length: 0
date: Tue, 22 Apr 2025 06:35:35 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OCEg0tZLw7M1QMhaOitWTHYCvKUaZ5To0WulbQUU4pZR2bF2gX%2FaauKojpWGt0oV0yQOEnFLtHA%2F%2Ffs1LbjCRqI4mn6HsP7tEax7TWYq2VtOv3iyyRqNVrgDMC0S0jB%2F9uI3nY0F1F2gEg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H2

200

sync
thrtle.com/ Frame C43A
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aAc4t9HM6fIAG3seAIGVtgAA%263670&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=4866c727-215e-4c81-9827-34672389d7fc&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=4866c727-215e-4c81-9827-34672389d7fc&vxii_pid=12&vxii_pid1=7006&vxii_rcid=7d486d78-c99c-4b63-95a8-e4426f02bcde&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=23d6d948-632a-4bf0-b755-25ffa2cf5d4c
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0
https://thrtl.redinuid.imrworldwide.com/thrtl?url=https%3A%2F%2Fnlsn.thrtle.com%2Fsync%3Fvxii_pid%3D5036%26vxii_ts%3D2
https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=007dd890-1f44-11f0-a1b7-73b52e03a985
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-KP3diq5E2oR.imV50Oy2C7c1_ngf1kNxH79o6w--~A
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=kjsBoStBXRhQoOMu4mDsNJfzjY4&_t=1745303737

43 B
540 B

46ms
46ms

Image
image/gif

34.197.53.184
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=kjsBoStBXRhQoOMu4mDsNJfzjY4&_t=1745303737
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H2
Server: 34.197.53.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-53-184.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Tue, 22 Apr 2025 06:35:38 GMT
content-type: image/gif

Redirect headers

Location: https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=kjsBoStBXRhQoOMu4mDsNJfzjY4&_t=1745303737
Content-Length: 120
Date: Tue, 22 Apr 2025 06:35:37 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame C43A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEIBhy0gGoUNMSFqQ12k7yg&google_cver=1

43 B
760 B

81ms
80ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEIBhy0gGoUNMSFqQ12k7yg&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ki1tDRYPQlTCT3movEnd3SHWAvtEn5%2FvWqkgXbvP8Ja8TzEVat3phwA228mr2sYCOdIleKhqfVdRYkHypHExYRWnKaEwlrKdzwVjaonLtBChz8uuGewAYawdzfQ%2BclSPv2Hdf3mDSvseQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a1d9aaa2394-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEIBhy0gGoUNMSFqQ12k7yg&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 364
date: Tue, 22 Apr 2025 06:35:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C43A
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&expiration=1747895735&gdpr=0&gdpr_consent=

43 B
771 B

36ms
35ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&expiration=1747895735&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=275eH1q%2FGnSi%2F5Foal3XpZqOgXDGuuD5hdEcdUv%2FXKM0vqIUDOWq8t9yvf%2B1MX%2BzbKngePVJUdgqDsPeGvQjHF3YOqbAQF4wVo8JbhyVS7cs8%2BMy6dIRX2kt5%2BYEfL%2FYX5L1dWh1NVin7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a1deab32394-EWR
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&expiration=1747895735&gdpr=0&gdpr_consent=
content-length: 323
date: Tue, 22 Apr 2025 06:35:35 GMT
server: Kestrel

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame C43A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAc4t9HM6fIAG3seAIGVtgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1

43 B
773 B

24ms
24ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2F6n%2BigWz5SpYDeDEvGqU55pNCuZwbg%2BcfKo%2FmU3o%2BJUOH9%2BBv%2F8XKeIYnJxPmtxNWGhuHdvHl27cU9cNIIWJj%2F5ByjULfH6kvOXcoiHiFgEfPkAqCIvM5%2FxyDNN7dnJLOZFvk36hW72LQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a1d9aab2394-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Tue, 22 Apr 2025 06:35:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame C43A
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=68
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=123&external_user_id=kjsBoStBXRhQoOMu4mDsNJfzjY4

43 B
771 B

32ms
32ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=123&external_user_id=kjsBoStBXRhQoOMu4mDsNJfzjY4
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2BVxtlqHEntYUUNwIvxT%2Br%2Bo0R8pHxJZpGrCcyVT%2B%2BgAzaDkIbvCulwuWK0MR0C3%2ButdDNsZ7grtx1WRcx7KHlKekk6khTMB3ggw0w7hOUwYYhiJ%2BV0KlQGgjcO6bbPDcZv%2FWuqXu6w0mA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a1ddaaf2394-EWR
content-length: 43
server: cloudflare

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=123&external_user_id=kjsBoStBXRhQoOMu4mDsNJfzjY4
Content-Length: 123
Date: Tue, 22 Apr 2025 06:35:35 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame C43A
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4161161628424474210

43 B
768 B

28ms
27ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4161161628424474210
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FsPs7uPf0Y2tiQBuF4rCfdcoBE8%2FN9OSpCEWPAIS%2F5hLNs1XNUlh2R4pKgLv%2F2NuYv3h%2BFp%2FucE4fhcmTiOQhhJTRwu27qmL%2BwzJzHx9gjNcAhWpf6FpOlydwfpnF1mZlme%2B8NLoIJGWXg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a1f7b052394-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4161161628424474210
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 3c2bbf26-470c-47c2-b4a4-4c6740750db5
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame C43A 0
164 B 1385ms
50ms Image
text/plain 35.153.242.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.242.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-242-12.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

date: Tue, 22 Apr 2025 06:35:37 GMT

GET
H3

200

rum
r.casalemedia.com/ Frame C43A
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=48
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&partner_url=https%3A%2F%2Fr.casalemedia.com%2Frum%3Fcm_dsp_id%3D64%26exte...
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&gdpr=0&gdpr_consent=

43 B
752 B

41ms
31ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=01msUbni%2FbnobQgc15KsRB%2FNf70QUxKosgmCx6Myqx92rr%2BxGDz7iGVIUQa6PjL%2B8nhFrjvVk0xej7sPj83nG2h5eYTv%2FVlSE0KfW18jvEUMnI3H8IAovnMuNX2VOBqK7Wzn"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a279cbf2394-EWR
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&gdpr=0&gdpr_consent=
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
server: Jetty(11.0.25)

GET
H3 200 setuid
prebid.intergient.com/ Frame C43A 0
824 B 77ms
64ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aAc4t9HM6fIAG3seAIGVtgAA%263670
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745303735&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=gtzYOk6W4za7fUwFuwWqGle9uA9Pb6oiUxux8V4VHfg%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745303735&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=gtzYOk6W4za7fUwFuwWqGle9uA9Pb6oiUxux8V4VHfg%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93431a1d68b78c27-EWR
server: cloudflare

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame DE24 5 KB
2 KB 303ms
23ms Document
text/html 172.67.23.234
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.23.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 725
apigw-requestid: JaTUvjolvHcEJGQ=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 93431a1f6f9f8c18-EWR
content-encoding: br
content-type: text/html
date: Tue, 22 Apr 2025 06:35:36 GMT
last-modified: Tue, 22 Apr 2025 06:09:08 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H3 200 stickyad. Show response
fundingchoicesmessages.google.com/f/AGSKWxWjKAjmSuRAgUkYuTP7-rSpKY73h5aqrTZrqpJIjKSUUDerFF3tL6TmClzjCp6MxYYiPWkPCjCnJOcp4JiS1GCEVFtgcjwsDzwTumq6O6TP7cdfJlpZi6AkkpUVFLlbDANL1-kDSkYlV0F-hjqvZdobaqYoE... 54 B
109 B 99ms
98ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWjKAjmSuRAgUkYuTP7-rSpKY73h5aqrTZrqpJIjKSUUDerFF3tL6TmClzjCp6MxYYiPWkPCjCnJOcp4JiS1GCEVFtgcjwsDzwTumq6O6TP7cdfJlpZi6AkkpUVFLlbDANL1-kDSkYlV0F-hjqvZdobaqYoEnam8UZIMGAurd_SOrwmnIwve-AIe3Gv/_/ad_sticky.-728x90_.650x100./ads_6./stickyad.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.TuzJwW_cQBg.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxJc3Db4Quci92H_jRIPF5Xa3XUpA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

125849d94df8c45d375a0424ebea97c880df1ad9bbda13a35df87c82891cad16

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zpP4PNkK2jMY-SRD6CtFnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmLw1pBiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkFeLm2PFxzgE2gQNXnikqaSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRqYGBnoGZjEFxgAAOS_OOE"
content-security-policy: script-src 'report-sample' 'nonce-zpP4PNkK2jMY-SRD6CtFnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 40ms
15ms Script
text/javascript 142.251.163.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.TuzJwW_cQBg.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxJc3Db4Quci92H_jRIPF5Xa3XUpA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

cafe /

Resource Hash

f88fd9fb064f0528d3dd22d33852e8baa94724247013aa406810b88bef04f0f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 17716711681685938139
age: 317
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 07:30:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 22 Apr 2025 06:30:19 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80843
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxX2YRZ3kTZSOHQD7yBLhgBSAXggbXgwJUVbQ8TUelHSC2ss6-RMZjDgMjdVvh0MwtyFI1aqvjI6aRTl-VAjVm2e-l8n-dOfxIPJTXMeRbAothsG5JefgX-BxSq7ysM1HgC1D14ZTQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 54ms
31ms XHR
text/html 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX2YRZ3kTZSOHQD7yBLhgBSAXggbXgwJUVbQ8TUelHSC2ss6-RMZjDgMjdVvh0MwtyFI1aqvjI6aRTl-VAjVm2e-l8n-dOfxIPJTXMeRbAothsG5JefgX-BxSq7ysM1HgC1D14ZTQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--JxbzWStGeGnNlOLCpR0Ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw15Bi-FB_mfUHEAtxc-z4OOcAm8COq695lVyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRgZ6BeXyBAQBaSSRx"
content-security-policy: script-src 'report-sample' 'nonce--JxbzWStGeGnNlOLCpR0Ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 56ms
18ms Image
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=a7a778a4-bc3c-4448-a574-8ee2b2ebc093&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qwxz.lixiuding.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=cb123f17-3989-4e72-8844-a7cd02f5b7ef&ccuid=5299629a-c3bb-47bf-8f29-629b324bc7a8&sid=ae1e3eb8-3a17-4382-bb83-361b86e80961&nct=1745303736000&r=https%3A%2F%2Fqwxz.lixiuding.com%2F&ns=true&lang=en-US&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&devicefp=151.243.141.142%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=6a6953d0-3f09-4765-915d-9da189c7300c&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Tue, 22 Apr 2025 06:35:36 GMT
content-length: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 45 KB
9 KB 358ms
358ms Fetch
text/plain 142.251.167.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1253058912959631&correlator=3178465959745813&eid=31091590%2C31091876%2C83321442%2C31091790&output=ldjh&gdfp_req=1&vrg=202504150101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745303736106&lmt=1745303736&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.lixiuding.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDhiN2FmN2FjLTZhYzktNDBlZS1iYTBmLTg0YmM5MzBhMzU0NFgBEigKEnJ1Ymljb25wcm9qZWN0LmNvbRIQTTg2UzRTSlAtMTItNVdORFgBEjYKDHB1Ym1hdGljLmNvbRIkMDhGQzk4MkItRjVEMy00RTkzLUI0QzItM0I5NUI4RERERUY5WAESPwocbGl2ZWludGVudC5pbmRleGV4Y2hhbmdlLmNvbRIdWjlKT2pzQW9KVVVBTi1PaUFKZldCd0FBJjI4MDhYARI3Cg1iaWRzd2l0Y2gubmV0EiQzMWFlNzI2ZS03MDgwLTQ4ODUtYTljOC00MTBlZjcxM2M4NGVYARIdCg5lc3AuY3JpdGVvLmNvbRiIltbh5TJIAFICCGQSGAoJeWFob28uY29tGNGa1uHlMkgAUgIIbxLuAQoIcnRiaG91c2US2AFHZ2JENlA0M3JvMUxHRnVWOFZBK3I1Nm50YUUzeDJJaEdNSkhYRUdkWjQ0S25aUWZSOTZHR1ZxazJMalcySktaTW9OdTIxRlhkYU51WWwxWm9WRjY0OWY5TDEyZkV0MkkvcnhyK2FKQ0p3MHVsOEpXVlZNRVJtOTVCR1BuMXI2VFZ1NUNUZlg5L1plMWZwTnk1U2hjRW5BbUlPV0JHVXlPNUpOWkJwQ3gxY2xWUzEzNXVKQng2Y3lHdWZra2R3MDZ5a3JHZHk4c3E0MVJCMnRuTmEzWW13PT0Y55nW4eUySAASFAoFb3BlbngY8pbW4eUySABSAghvEhsKDDMzYWNyb3NzLmNvbRiIltbh5TJIAFICCGQSUwoNY3J3ZGNudHJsLm5ldBJAMGU5MWU3ZWZlOGI0ZDM0ZjYzM2RlMDRmYTYzZjE4NWNhMDJjYjU1YzE1Y2IzNTE4OGI4N2Y1Y2ZlZDliMTJmMlgBEjMKCW9wZW54Lm5ldBIkYmU0ODM0MjYtNDdhNS00MTc3LTkxNTUtZjRiNjIzYTM0NGQ5WAEShwEKDmxpdmVpbnRlbnQuY29tEnMxNC1zWmFSWFBOdnQ2MVRqV1M5U1AwbkZrV2NZRklqY1R6blVWK1pJZG9veGdqTUNTamRlTVluZU56TGRzUlJmRWZ5MEp1NHJpN09JNDZQN0o3NTI3a1U2c3VXbVJETVduM2dLRllhYTNza2lUcm5uUT09WAESNQoZbGl2ZWludGVudC50cmlwbGVsaWZ0LmNvbRIWMTMzNzMyOTA4MzU3NzU2NDUzNTMzOVgB&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745303734130&idt=699&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D8f79ce6e9bb349d0a1907b47f8eb857603735211%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26bid_type%3Dserver%26hb_format%3Dbanner%26hb_adid%3D1390dcd60ad7c2168%26hb_size%3D160x600%26hb_pb%3D0.22%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_cache_host%3Dprebid.adnxs.com%26hb_bidder%3Ds2s_ix%26hb_cache_host_s2s_ix%3Dprebid.adnxs.com%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.22%26hb_adid_s2s_ix%3D1390dcd60ad7c2168%26hb_bidder_s2s_ix%3Ds2s_ix&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D469762048%252C218890240%26cc-iab-class-id%3D482%252C283%26cc-iab-name%3DShopping.Children%27s%2520Games%2520and%2520Toys%252CHome%2520%2526%2520Garden.Interior%2520Decorating%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.lixiuding.com%252F%26tyche_code%3DV.20250415.1%26pageos_code%3DV.20250415.1%26config_id%3D1024872_74068_primary_config%26hour%3D20%26day%3DMonday%26referrer_domain%3Dqwxz.lixiuding.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250415.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=2785&tan=e21f22df-d016-4db7-8bd9-d676fb3d4e5f&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

079d28bf8d41a8fe728f7cf0b4fab814e8f75b29516cd712b531707e42236c7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: 125064
google-mediationgroup-id: 100271
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 9695
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame E6A2 7 KB
3 KB 42ms
16ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f132.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 06:35:36 GMT
expires: Tue, 22 Apr 2025 06:35:36 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX2YRZ3kTZSOHQD7yBLhgBSAXggbXgwJUVbQ8TUelHSC2ss6-RMZjDgMjdVvh0MwtyFI1aqvjI6aRTl-VAjVm2e-l8n-dOfxIPJTXMeRbAothsG5JefgX-BxSq7ysM1HgC1D14ZTQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_5BA_wtSMhQMoFcyyjUzxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAtxc-z4OOcAm0DDpJYAJZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRqYGJkoGdgHl9gAAAnCiPD"
content-security-policy: script-src 'report-sample' 'nonce-_5BA_wtSMhQMoFcyyjUzxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX2YRZ3kTZSOHQD7yBLhgBSAXggbXgwJUVbQ8TUelHSC2ss6-RMZjDgMjdVvh0MwtyFI1aqvjI6aRTl-VAjVm2e-l8n-dOfxIPJTXMeRbAothsG5JefgX-BxSq7ysM1HgC1D14ZTQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dKL9nIbrGBNNgwGpJHXscQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1JBi-FB_mfUHEAtxc-z4OOcAm8CNDSsLlFyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRgZ6BeXyBAQBcryR_"
content-security-policy: script-src 'report-sample' 'nonce-dKL9nIbrGBNNgwGpJHXscQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX2YRZ3kTZSOHQD7yBLhgBSAXggbXgwJUVbQ8TUelHSC2ss6-RMZjDgMjdVvh0MwtyFI1aqvjI6aRTl-VAjVm2e-l8n-dOfxIPJTXMeRbAothsG5JefgX-BxSq7ysM1HgC1D14ZTQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_9O9VERe_DgF3_dR1cmFaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1JBi-FB_mfUHEAtxc-z4OOcAm8CGVc8LlFyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRgZ6BeXyBAQBg2SSP"
content-security-policy: script-src 'report-sample' 'nonce-_9O9VERe_DgF3_dR1cmFaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUa5nM9yFORIZPLiamfOdGL5P4iaVEaseDsDc3o6kVHXTyRA-gHopdaXKmOcaKV4t2W38Be7uSqcyi8w0YyKXugF9mVakwS7Ttp1wc72jm8mSLB18wof96EHkK5ie-3UcqIcMmDCA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 51ms
50ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUa5nM9yFORIZPLiamfOdGL5P4iaVEaseDsDc3o6kVHXTyRA-gHopdaXKmOcaKV4t2W38Be7uSqcyi8w0YyKXugF9mVakwS7Ttp1wc72jm8mSLB18wof96EHkK5ie-3UcqIcMmDCA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1MzAzNzM2LDE1MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJUdXpKd1dfY1FCZyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmxpeGl1ZGluZy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cc04449b0232e3cd7fc13d0e90a3e94c145f7cd18609c2d1b310c73c9220885a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-54If8ovdAtqDitF3dtXp6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjCtDikmJw15BiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkFeLm2PFxzgE2gRMd3VFKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgYmRgZ6BibxBQYA0LY4dw"
content-security-policy: script-src 'report-sample' 'nonce-54If8ovdAtqDitF3dtXp6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 186ms
184ms XHR
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

ac2fd0d8b165a145d8f29e98c736f5940ae1c725e69c0d6be9d11cd30b45ab34

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/json
vary: Origin

POST
H3 204 AGSKWxXJvjjjRyZfhKQgHlBPHVtVFUDyvqIqQXccNfrnX1-5GO59a8Sk_MysQGDCbi10sBgej4ngUtr_CqDldWlPIF9XHpCh3ISSezU6UtgrJ13E0AyaFmF9gMvVAIMR-RyXqa8iom1kXQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 32ms
31ms XHR
text/html 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXJvjjjRyZfhKQgHlBPHVtVFUDyvqIqQXccNfrnX1-5GO59a8Sk_MysQGDCbi10sBgej4ngUtr_CqDldWlPIF9XHpCh3ISSezU6UtgrJ13E0AyaFmF9gMvVAIMR-RyXqa8iom1kXQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-_Mdt06FcstPeBrpho4W4cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAtxc-z4OOcAm8CDm1fzlVyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRgZ6BeXyBAQB4RSTf"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-_Mdt06FcstPeBrpho4W4cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 224ms
216ms XHR
text/plain 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 93431a2098ba6da2-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 139ms
112ms Preflight
text/html 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 93431a1fd8106da2-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:35:36 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame DE24 0
140 B 142ms
112ms Ping
text/plain 172.67.23.234
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.23.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 93431a20ad1de8a6-EWR
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Tue, 22 Apr 2025 06:35:36 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 112ms
91ms Preflight
text/html 172.67.23.234
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.23.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 93431a1fda2820f8-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:35:36 GMT
server: cloudflare
vary: Origin

GET
H2

200

9.gif
id5-sync.com/c/483/1241/0/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*A8BBWVPf0LjCNpUvJFhY4UR55TBEdRnjXJI1afYm69gRGDRf1M1bdA6AHaeuDMls&gdpr_consent=undefined&gdpr=false
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F7%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/7/2.gif?puid=2acab417-f039-4b41-9fbf-a02a658fb7c0&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/6/3.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/6/3.gif?puid=4161161628424474210&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F5%2F4.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/5/4.gif?puid=7edaa645-9c2e-4a95-9b1f-232667ac578c&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F796%2F4%2F5.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/483/796/4/5.gif?puid=e1488854-f7cf-47f3-892f-efd0e3df6b9c&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AADRYk7QDnEAABngXp_QgA&id5AccountNum=155&numCascadesAllowed=9
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c0eaMy_0gKLGsRdEqHzZJInBCCSFPds8YhFRltbP4A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F2%2F7.gif%3Fpuid%3...
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c0eaMy_0gKLGsRdEqHzZJInBCCSFPds8YhFRltbP4A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F2%2F7.gif%3F...
https://id5-sync.com/cq/483/124/2/7.gif?puid=c8e82f51-2abe-4b86-abf9-c55c9bbd500f&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F1%2F8.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/1/8.gif?puid=u_aec062fb-a2fe-4222-8284-5fe6424813f2&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=85&3pid=AADRYk7QDnEAABngXp_QgA&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1241%2F0%2F9.gif%3Fpuid%3D%5BSOVRNID%5D%26gdpr%3D0%26g...
https://id5-sync.com/c/483/1241/0/9.gif?puid=KiZLALZHKkv37wMzQRKleLKo&gdpr=0&gdpr_consent=

43 B
1 KB

130ms
129ms

Image
image/gif

162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/c/483/1241/0/9.gif?puid=KiZLALZHKkv37wMzQRKleLKo&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Tue, 22 Apr 2025 06:35:38 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://id5-sync.com/c/483/1241/0/9.gif?puid=KiZLALZHKkv37wMzQRKleLKo&gdpr=0&gdpr_consent=
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Apr 2025 06:35:39 GMT
vary: Accept-Encoding

GET
H3 200 container.html Show response
4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame AB2E 7 KB
0 0ms
0ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f132.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 06:35:36 GMT
expires: Tue, 22 Apr 2025 06:35:36 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame F3C1 0
0 106ms
53ms Document
text/plain 159.89.94.55
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=665db4754b2ec067196b8f78&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.94.55 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Tue, 22 Apr 2025 06:35:36 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 172F 20 KB
7 KB 16ms
15ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=88629
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Tue, 22 Apr 2025 06:35:36 GMT
expires: Wed, 23 Apr 2025 07:12:45 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 700C 1 KB
2 KB 84ms
35ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 59bb744cc32a48a9162b288e4a6f7268c6ce0db342032dfd62547421d2264faf

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:35:36 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 948A 3 KB
2 KB 56ms
20ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 333
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 93431a2218ee0f73-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 22 Apr 2025 06:35:36 GMT
expires: Tue, 22 Apr 2025 10:35:36 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 91FF 16 KB
6 KB 21ms
21ms Document
text/html 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 06:35:35 GMT
server: Kestrel
server-processing-duration-in-ticks: 826776
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame D725 11 KB
5 KB 78ms
51ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4dba0fce354b5d56d27e0593143dd54823eebeb46cb24788671a0079a34c463

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93431a220faec33f-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:35:36 GMT
expires: 0
last-modified: Wed, 16 Apr 2025 11:15:45 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame A6F8 269 B
379 B 788ms
82ms Document
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Tue, 22 Apr 2025 06:35:37 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 342B 52 KB
17 KB 89ms
8ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 64038
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 22 Apr 2025 06:35:36 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 129020, 109733
X-Served-By: cache-lga21993-LGA, cache-ewr-kewr1740045-EWR
X-Timer: S1745303737.700878,VS0,VE0

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 1981 803 B
1 KB 585ms
233ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 2998aa7355b4cd92d533ed4cb0cff4ab87b778a650243bed90de1b8097a3383e

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Tue, 22 Apr 2025 06:35:36 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 151.243.141.142

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 162ms
161ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
661 B 21ms
16ms Fetch
application/javascript 52.3.206.124
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.206.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-206-124.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: c9cfb8177353075d749a3c1139615314eb63d4ceae913a1ea85050312eddc9c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 22ms
18ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&fp=52oRtw4cCPx4ba1%2BiUJEatf0eD2T8paPSubXHuFGSJc%3D&tp=reuters.com
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: a55a5b5ca26d57b697a4aa500ef3fd7d6d4ad77e3cdaaef5c0733b2af2a53dc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1677
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 520 B
0 2ms
2ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jse3b2wmp0emy3n46wyh2e4s&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-72-103.compute-1.amazonaws.com
Software: /
Resource Hash: ca91f7d34cb9a03792428cbce4a58490ee508f2d3229be955fc510523b6c1aae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: eec94bf1441f7da5
request-time: 11
access-control-allow-credentials: true
expires: Wed, 23 Apr 2025 06:35:35 GMT
access-control-allow-origin: https://paint.toys
content-length: 520
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 421 B
1 KB 19ms
15ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=xixDAF81NjhMdktJTlBLV2VSRXhtcDIzQlRsMVdzd3Z2cjFNOXg3eE5TY1F6U0RYeTNERXo5a0wlMkYwcUtkeUtRWGxrMjJncmRMT2VRSmJ3Z2xPUFhtSGs5JTJGeGhFVFNLNCUyRk9nRnkxakt1enE5d1klMkY4Sjl1eTJyT0REUjFzMmVCVjVoVDNOc20ydmJYaTcwcG5pYTZnS2l5dXA0ZyUzRCUzRA&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

abc0ed1157008f9efcc4dccec59e89de33528420c09b0227fffaa593d9694691

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 863034
expires: 0
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 781ms
354ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

GET

ibs:dpid=903&dpuuid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam

0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 17ms
14ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 22 Apr 2025 06:35:35 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 270689
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame AB2E 0
0 90ms
89ms Fetch
text/html 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C8USKuDgHaOfqD8KZ6toP-trdgA6eoaGuXKH56P6fA8CNtwEQASAAYMmGgICAgIAQggEXY2EtcHViLTU4MTIzNTczNTIzMzUwNzXIAQngAgCoAwHIAwKqBOECT9CNMjF6b8ekfm6MUBtpOWwT3WmcfxG4avZY_j79G7Oue4G91XJX_vaeNaItquueGLC4qMzPBO3wym__oskQDg-DNsy84lsBAi6NMRusDYCucSWUXyVI0nHjccQztwv2kFvvRuDpkf6r81ZWruiBw6mmz8mRmPKLMZL5DxZn8ArwB-8vCehOPeJR2b7yPQj1a9Na5_KCL3MTfHQn5qnkTW6yTErJxfke_uPnvsdmZQ_i27LjYBdhfEZUPZM-9TPBSDP_Om4BplntzGcSSOUPaUILaAsL-kPMELjcved5xXhcTGGd50-Cvnzj-3Bg6Mfq8yh_a1J817QvczYemSaxBJiFLvmbNOUOP-1WJJLhONcUG1Zb5uRUwkco70YIGtuzsCAj3SfoCJElDHMmfsIL5yhT1hr7NkaUgbWsCL_rgFNN0UL7nB5Pd6sb3OgPFqzS0gIZIMP5zjaWkIWd83-qtBjgBAGABubgyJ7NtLimKqAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQKoB62-sQLYBwDSCCUIgGEQATICigI6DIBAgMCAgICAqIACIEi9_cE6WIyt5ImD64wDgAoD-gsCCAGADAGqDQJVU-INEwjF5uSJg-uMAxXCjFoFHXptF-DqDRMIoM_liYPrjAMVwoxaBR16bRfg0BUBgBcBshcqChoSFHB1Yi01ODEyMzU3MzUyMzM1MDc1GNuiIRgLKgoyMTg0MzY3MzQ2&sigh=6LSlVoQb9uA&uach_m=%5BUACH%5D&cid=CAQSOwDZpuyz2uZTQHEMqoQNW5l6xFoQjIIzpZH7kIpSmRHJxXyi5DekLddvhaXBJHcNVAcBa_v8RojRM-k_GAE
Requested by: Host: qwxz.lixiuding.com
URL: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ww-in-f154.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1ED3 663 B
254 B 138ms
112ms Document
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKzgURDY1HwYvZ-dswIwAQ&v=APEucNWRTDnlLu2nDV2fRe53VZX-rR1LOQst9JDpuvqUFhBNe2af23_Lu8tz9Qaz7VeSNfLVMkvgB7zZuu95Ug5aK5FCm08gJw

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

962d6dea088b031cd44d33f937adb5ba241a9435aa32a8be667d57482b8bbe1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 06:35:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame AB2E 110 KB
37 KB 56ms
32ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18146946010209014275
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 06:35:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38116
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK 36809b2e-8749-4e3a-b4a7-d0f34105d72b
a1662.casalemedia.com/impression/v2/249611/85/d03jhe10rqg30b22bokg/ Frame AB2E 43 B
303 B 286ms
231ms Image
image/gif 192.40.36.186
CASALE-MEDIA

General

Check archive.org

Download Go to Show image

Full URL: https://a1662.casalemedia.com/impression/v2/249611/85/d03jhe10rqg30b22bokg/36809b2e-8749-4e3a-b4a7-d0f34105d72b?verifieD=1&userID=aAc4t9HM6fIAG3seAIGVtgAA&cmpro=3670&deviceType=2&expiryTime=1745304336&profileIDs=&creativeID=12bc17d&pubID=186779&format=banner&channel=site&ap=aAc4uAAD9WcFWozCABdteheXhPtb4XfzLXyAvA&ee=1
Requested by: Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.36.186 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Expires: 0
Access-Control-Allow-Origin: *
Content-Length: 43
Keep-Alive: timeout=1, max=500
Date: Tue, 22 Apr 2025 06:35:36 GMT
Content-Type: image/gif
Server: Apache

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 42 B
63 B 75ms
53ms Image
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BlHMPdG5ujnu-9NUx-hIe_b4W4rSRGoKX4dUSpxpRps768zlGIE0xp830bu_2rFTGHXf8P8DJYrmvQYiooJgmTxhZ3T3NVZ6Mft46HtEGtEykSmkU

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250421/r20110914/client/ Frame AB2E 3 KB
1 KB 76ms
31ms Script
text/javascript 64.233.180.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250421/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ba1a463f7811ae10ea114a0bcc044c05c391ec1fcb3dd5a7bd9d9bb3fe2b070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14574132110251334613
age: 60236
x-content-type-options: nosniff
expires: Mon, 05 May 2025 13:51:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 21 Apr 2025 13:51:40 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1242
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250421/r20110914/client/ Frame AB2E 19 KB
8 KB 76ms
31ms Script
text/javascript 64.233.180.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250421/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b451ccc7da3e70b543ef7641464d3282394801fe9d55db35f5ef761289829e0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 9111891619109543697
age: 60312
x-content-type-options: nosniff
expires: Mon, 05 May 2025 13:50:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 21 Apr 2025 13:50:24 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7958
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame AB2E 0
0

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-41/js/ Frame AB2E 25 KB
7 KB 74ms
30ms Script
text/javascript 64.233.180.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-41/js/ext.js

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7545b5d8b366cf7960d74ef16f2c98425f17d34a392e909bdf5fa53f340b134

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 06:35:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6870
x-xss-protection: 0
server: sffe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame AB2E 221 KB
68 KB 35ms
15ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdd6fed4ba9bb0835886b23fac1450854f27b44b0eec1be73e0f1acf7e93d017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 2762217307112662222
age: 239
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 07:31:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 22 Apr 2025 06:31:37 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69482
x-xss-protection: 0
server: cafe

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 91FF 2 KB
1 KB 20ms
14ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&bundle=rj4fJl9TT1VJN0tqUzV1N1BhQ0FlOFhmdUp2NEpHWVZuVE1hVGN5UUdwUk1Sd0VBUE9JZGVmUyUyQnJCUm9wTG96VjVHaGRKcW94YzhndEJ5Ymw3NVVuTng4RE5Ya3VQWFRDSnFJNkhDYUN4dnVIVjJqcW9ucmV6JTJGUnBCNWpnekFXdHdDN0Q&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

9387c8f78de4f9c2c2c4c176fffa41524fd53eca2218d041f45a51c248aac691

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1189372
expires: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 181ms
175ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

3caef4ea344b3d374510215daf880ef43e041e4071a4327997664c9cc4240cf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/json
vary: Origin

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 172F 5 KB
6 KB 334ms
6ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=21531318&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 01da0950e26b5c27d6af84329b9d20873e78572cbf1f6d5e2fe4ca0f936c3170

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

xuid
eb2.3lift.com/ Frame 700C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

242ms
235ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Tue, 22 Apr 2025 06:35:36 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 700C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEM7NTRcGVHeJAZhQ5hCI7EU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
476 B

20ms
17ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEM7NTRcGVHeJAZhQ5hCI7EU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEM7NTRcGVHeJAZhQ5hCI7EU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 700C
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Mjg4MzU3NzYwNzMwNDc4MzE1MTMxNw%3D%3D

170 B
188 B

29ms
28ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Mjg4MzU3NzYwNzMwNDc4MzE1MTMxNw%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-81-174-250.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Mjg4MzU3NzYwNzMwNDc4MzE1MTMxNw%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 22 Apr 2025 06:35:36 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 700C
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Mjg4MzU3NzYwNzMwNDc4MzE1MTMxNw%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

218ms
211ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 700C 0
249 B 241ms
61ms Image
text/plain 150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2883577607304783151317&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 094ED71410544C848DFB61270DC5EABB Ref B: TEB31EDGE0309 Ref C: 2025-04-22T06:35:36Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzWDFDoZozUD79ulmXiQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT

GET
H2

200

sync
thrtle.com/ Frame 700C
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=2883577607304783151317
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=4866c727-215e-4c81-9827-34672389d7fc&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=4866c727-215e-4c81-9827-34672389d7fc&vxii_pid=12&vxii_pid1=7006&vxii_rcid=23d6d948-632a-4bf0-b755-25ffa2cf5d4c&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=23d6d948-632a-4bf0-b755-25ffa2cf5d4c
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D3%26_t%3D1745303737
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=4161161628424474210&vxii_ts=3&_t=1745303737

43 B
540 B

39ms
39ms

Image
image/gif

34.197.53.184
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=4161161628424474210&vxii_ts=3&_t=1745303737
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 34.197.53.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-53-184.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=4161161628424474210&vxii_ts=3&_t=1745303737
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d911b278-9cd9-4cd2-96e3-a909f805796d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

xuid
eb2.3lift.com/ Frame 700C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2883577607304783151317?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-MlHvUC9E2oQtoJcRhvYXZJc442J2ETk.CLH7.bUdpQ--~A&dongle=0883

37 B
476 B

126ms
115ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-MlHvUC9E2oQtoJcRhvYXZJc442J2ETk.CLH7.bUdpQ--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-MlHvUC9E2oQtoJcRhvYXZJc442J2ETk.CLH7.bUdpQ--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 700C 42 B
689 B 350ms
298ms Image
image/gif 150.171.27.10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2883577607304783151317&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "a5bd2ee42da8db1:0"
x-msedge-ref: Ref A: 0260FBCC855A452D904A98D28570E089 Ref B: NYCEDGE1410 Ref C: 2025-04-22T06:35:36Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
last-modified: Tue, 08 Apr 2025 02:28:19 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 700C
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=583075c2609511fb&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHYla_358pZAIU2oSgAQEBAQEBAQCXXTSScQEBAQEBAQEB&expiration=1745390137&is_secure=true&gdpr_consent=&gdpr=0

37 B
476 B

22ms
17ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHYla_358pZAIU2oSgAQEBAQEBAQCXXTSScQEBAQEBAQEB&expiration=1745390137&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHYla_358pZAIU2oSgAQEBAQEBAQCXXTSScQEBAQEBAQEB&expiration=1745390137&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 700C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-923b01a1-2b41-5d18-50a0-e32ee260ec34$ip$151.243.141.142&dongle=4430

37 B
476 B

226ms
224ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-923b01a1-2b41-5d18-50a0-e32ee260ec34$ip$151.243.141.142&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-923b01a1-2b41-5d18-50a0-e32ee260ec34$ip$151.243.141.142&dongle=4430
Content-Length: 141
Date: Tue, 22 Apr 2025 06:35:36 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame D725 4 KB
1 KB 81ms
72ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb853ad6fd1144f5de9d84aab6299eadf8684843b472eac31a48858de5caa882

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93431a22afe4c33f-EWR
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame D725 19 KB
7 KB 354ms
42ms Script
text/javascript 104.16.80.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.80.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 93431a24bd2ba506-EWR
access-control-allow-origin: *
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 568ms
250ms Image
text/plain 3.81.174.250
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.174.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ 43 B
92 B 655ms
354ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=criteo&custom_data=4KMHBl9xYUFhRjJGekdrJTJCdUo4TE5pbDNxZ2FIbjFCaHp4WDJiNFBWMzZwcE8lMkJTUSUzRA&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-JfvB9FNMuuURGX96bcRTqsjEFpiT8Q2aRyCXoQ
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dtDlzVF9WcGVYdkpKeCUyQlRKa2xpMlR2SE43MXZzRE9PZmxxTUxEQlVPMHZqTjlrQVElM0Q%26u%3d%24UID&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=tDlzVF9WcGVYdkpKeCUyQlRKa2xpMlR2SE43MXZzRE9PZmxxTUxEQlVPMHZqTjlrQVElM0Q&u=4161161628424474210&gdpr=0&gdpr_consent=

0
141 B

294ms
245ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=tDlzVF9WcGVYdkpKeCUyQlRKa2xpMlR2SE43MXZzRE9PZmxxTUxEQlVPMHZqTjlrQVElM0Q&u=4161161628424474210&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Tue, 22 Apr 2025 06:35:36 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://ssp-sync.criteo.com/user-sync/match?p=tDlzVF9WcGVYdkpKeCUyQlRKa2xpMlR2SE43MXZzRE9PZmxxTUxEQlVPMHZqTjlrQVElM0Q&u=4161161628424474210&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7898e931-6148-410d-a32b-6576f45f6801
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-JfvB9FNMuuURGX96bcRTqsjEFpiT8Q2aRyCXoQ&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
https://ssp-sync.criteo.com/user-sync/match?p=0inw-V93ODZZWXFhTEZkVmE1V2MlMkYxcXJ1dDNtNDkxTEtnenNIaG84TVNEYyUyRlRUMCUzRA&u=CAESEIbGUZRvv2lYYhZ37nwoHhw&gdpr=0&gdpr_consent=&google_cver=1

0
142 B

212ms
23ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=0inw-V93ODZZWXFhTEZkVmE1V2MlMkYxcXJ1dDNtNDkxTEtnenNIaG84TVNEYyUyRlRUMCUzRA&u=CAESEIbGUZRvv2lYYhZ37nwoHhw&gdpr=0&gdpr_consent=&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Tue, 22 Apr 2025 06:35:36 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/match?p=0inw-V93ODZZWXFhTEZkVmE1V2MlMkYxcXJ1dDNtNDkxTEtnenNIaG84TVNEYyUyRlRUMCUzRA&u=CAESEIbGUZRvv2lYYhZ37nwoHhw&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 398
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3128279717856594852

0
144 B

236ms
231ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3128279717856594852

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3128279717856594852
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Tue, 22 Apr 2025 06:35:36 GMT

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cs.admanmedia.com/e805be652c9053b8f771665f0ac3c361.gif?puid=k-JfvB9FNMuuURGX96bcRTqsjEFpiT8Q2aRyCXoQ&gdpr=0&gdpr_consent=&ccpa=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=[GDPR_CONSENT]&gdpr=0&dsp=507&buyer_id=40e9cf98-80ff-4109-81da-992986c45b68

0
144 B

118ms
25ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=[GDPR_CONSENT]&gdpr=0&dsp=507&buyer_id=40e9cf98-80ff-4109-81da-992986c45b68

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

expires: 0
cache-control: no-cache, no-store, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=[GDPR_CONSENT]&gdpr=0&dsp=507&buyer_id=40e9cf98-80ff-4109-81da-992986c45b68
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
pragma: no-cache
server: nginx

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 342B 0
922 B 17ms
10ms Script
text/html 68.67.181.231
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.231 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: ad4c0805-67ba-402c-8c85-b3916c3b0c11
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 91ms
89ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

2bd667d706761b84f9c5d73303d446500668a69bbc3c758904347adc17f79f98

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 22 Apr 2025 06:35:35 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
20 B 53ms
53ms Ping
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6587462428418&version=m202504010101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
20 B 37ms
36ms Ping
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6587462428418&version=m202504010101&ct=76&x=13&cor=8238842240007621000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AB2E 115 KB
45 KB 55ms
54ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzKchzyytlOG4u0JaebvNHS_CkpIPVsBbpTBwjBC8lVXlKsEsFFrZX-laGS7NgEZw0G2z_xX3UcFkjEYYwJ6p4ulKXmY4maUPs5vCeTeD8wbiyey7hs2HKT22kBj1O24qbpiwlF9zw24R4B4MIhw7VfgHMZNyvWOx0AYHUF2esNPaI-p8K8B8lOa5xmQkrbt8YrqpaxXlBV1LoDC_e99zkZpGJIIkzEuW_YRPFJfqqeLRw-lCm8Lg3m8SgBj24GvYj1fipgdEmYM9T_bTMzGpmU93fNw&dbm_d=AKAmf-DhOPz4jXYvswYkTHZMktcBJ5fcMSs2qkhsudXu_DdSJCHxzdWR7r507k_28JyH3C06nyC4iXqrNcE0zqs-HMguYPAmBc9YKgFaH1_CMuJieqzlzLOfg2xu02POwFbTGIXdPI30PuaxjVwzA8WyjbR80ZERKI0VoIGEzbzcUV_PyfZpRQJI5VUTvoNGetNdve_p3HSgt91X1yD3Fd4MWj5auFsoLibJtZCmv590xNIhf_M8HrEdqerIIrlR6lM0KB-mmzFPjlLHINmANFM1LVdL5NKGxF66yfPAa8E-IT3KsLNePbh1RW_N2vzBzWQaTTRhdoqT7lOk13JbNqq-Kdvh4kDH0ZaLVUlILcNfbOtsICkcz98ZlQK0B441oPgWvY84kH3vMRSu6PpX48OHrfVF-Np_d3pjx4UrfeUrwcVGx_KHNqRR1dldFDpKjy6TksCN4GwtX60Exr3ESeMdvK-ZRAGbhiOHh4u9FSZE3pxP5C6L0uI6GavXN8Ypo4ndfeE4w3oQQIU9_w1jGQDLoAZ3EscdkVuJfNtRsdCKuC52twPetnc62e3ujb8u7FTUiGIAGzIfvw4PiPv0MGByBZReOV0e-n-OJ-XpW3n4-acMsP7N_1KN_cN14OYnqcB6JsA4267mNDOVdtOPzaddgXCicalZfASOAebFwQMtx0w7vIRc9drj8isMKmonsKlp6_mN5iqSibm69DNeqBbwY7YkiiSp_hPGugszKtDhoqY0_U88zhV6ORvCFMWGtmjn0effSGb97lPhf43pVDpzxRr_pGbtm84HVIxDUx8C5EF9C7VS0sX-Tflr0xA_QJLcmUkXe-4CAGXQa9-150kxnMLdLFSRdRyhLi9M5FBC_rJ4crs_0LRcXDvn8IH_O6iuDSwCnoT8p0GIUvzHmxiL-2ZvrABlc3fgsCU_9gAgjUtLHtR5aIscrcFyx0rCC8EL4zEpEAz8u_IYCV2seFj-6_i4SovRAQahyk0-q92pB2tHUHL-vPVKkBKNrW-kqpBBvVllmy3taoeQic65tqmLA_ov3ZWmTfi0GGfGXko1kVXmalzzZ8CO8i7x0lc008bDTaMcVnXWgeeFA5jSLozI3OwQ809mulpxF5s5xYs4AGnXKx7fk3wzgf2MKYYZjbPyO2gQXYki2RTbWjXOBBl3rp1xlV0sx0Qr-cmnObTkxKd4x3zSmziSN_t8V1QTw_7KhXlqJByKrInuCxAzHsHafKwyibBZM4M2ixcdHbcRNgm3awqE5hF5rdtavqipgIo1rAI61haN2dFXHxajouUHzPV_AKqgdnHmRTI2VUsLfJg_7IRUV1wrDcSEqhSTivYLHvsTHRFfmCTv0GlqY6UfQvS6DTyQHo1C7JEE072MB0aUzL6N7N4gzxq-eZd8ikMioz28gDAK-GTauh4qFLwsscLnIk6D1RHmbe0M05buEiUWztDkaBasgTTNOiU_f5yFpNbpJbfRBUz-NkoYFvMdcOYXw0wW_LqTfPRSZjjLtzgBMig2Vh9HRqGfWPrAvMQhUiikFNLqZndKE1DAKZ9lMPG-IiwrgluQ_53U6792Nyknv4_jPwdGc4MP8evwthkZvYUOZC0Vdn9imTaowNGZT9kKyY0mJcB2keZ8dmO_xb3oHfWg_veG7ZK66aex4edqrZGjlCjgiJU-I2_IFu0_3qv9QFWBad5ScyvHlitWXj8g0gofboFnr6TF03GhIZluN0x1hjl0i1fz_33_X-0q5gkZ1JINt6IepVgbwQR1L-89GCrs_LHKVxeNinEiE4u0CtbRV5F-OA48F-7MBgutp0bg1I7UjJH3CHuGUD39t3BwyODy1_d_uNP-RJkkc2zWQJHaQMghs0qy80rTpvZ5-lm-PbtDKZuwz9xeQw05wU6e7r3JrUzMkknNBJl7QvdqmoMuEKo7KOJZPBFak2VWNAh-Lm1zu4ZBF9qBlVo8cjQSAN765FFy5vCIXX2mOozIJrjag5d5qkTglw3-zBnuFaDFddQqxzZvGHaeIaU-WGVAxQoCzE98gvHRgC_IiWzOUrIi7kv8UY1YuUZN0qty6wBxLyimkSuG2Vc0x4DADIxS-n6nu4mclxg_1PWS-fzq8cLeCoNZWcALqtrZUeRh3Yk77CqJUFZAzxHbo2xNCaE2FTAJYwJFZcMGeX3rNbUzxcNgWGXMlGH0n9Y7-_2RufcHldzOEySxMkHC1GdQ57udKuOXSePGE_v6NpMxPQLq4kWlfFOjxeydeX3OMVpLmLybvAB5sLLnm1z5iZbXT9rzPqF9cTfh2pKHtmyKBDRPb0IP8elk9PvykZQFiIN-akw_a5W1yCrqMUXY3rDE4U_6v1eo4DTr6YArB1Xh7avyiUFtXkZx_cVdxjI1cmVuCdux3DQYWGfSKCeVHeiv-bgfR1AqDW2ILdbQvqg1QlaVzjh4dwPKQy1WF0QyqkYJWEi37tMwnZCnGosbq3A1LXX-XOIuLhusrOjFr9Kq6Wii8H_77pUw_UZa4AayS0_zId98S97eDH1iFWxnukGmG5WzMGXUPUHQIFX5YHf-IBvfv2qiaimYE2fd9TJleueyxCtbAP7AeNpGB0XZVrn0b40U26Hn-o89iPDax-Mf6_XRZQ2Bon2PrpGz_-ZjcwmX2EalRpNA0Gf02vXXBWjAzg9EqhqupHpvA9Rhot9mGKaPQ5BS41DWgJ1wLo27bASXKOrZ9j-MzZIPSpKeMYtt92uzgHBNUBvVNjQhL7Sf9xNf4NhqY4HYAz_O_GOWPvlmHaInLz6xZiDAscMSv9JL1lLkF7_qFSC7WZUUgAj5j9ttDyoxtrjMYpOkgGsujM36dK6i7a2TQmXM8nU4I-iOqjo9vryPDafZUl1CcLutpDxKPPwZMcv2SxW_NxUFK-ulari37XC_gnww9bjmiEaucfTRjYof0bUpEBBfvRgRirLO6RmicreKwTBmpaERDwPZbVicXKoc9bGPxhyPIAAhcsOzuoICRm85UVY_BkuSoGUFZlXbL0WEkttc3KZoy2tAZAnypiLM9QXHtSq5wXNRh4cY8qx8RfZaLnqpNzMja7m0zMt-7JvsE53o-j71Mz0CIoYV-3LSuKwcz68Nf7nlaAwQkoGG7tdCSyiuruwNsblmhdhf1TGcA1ec_pljRidH8giR-0xj-qQqZQVcbZzbgtwtqb8YLjTTAMIzp4TmclDrzuYrRmjbNjAt8xuqioV-jgpPvuhhGK30rsT8zFgz6j4rtkek_t3NZCCj08l8UuItkUaDdFKfWHn8xkFafqQXGNZmBGwf7NCREZ9yrfB5IslMCgf71kYAmnlPfk-XFe_UZvUwAt3Ddlz9zarn7CaEYBUeQcDQcWdpDGO9nEn--kzImg6ReVMvVCLNK_36Zs60PdzDJVHp6CRx6QR0FWyTMtZ_JiKUMMyjdo4N6f2jZ_nPqvoAvggYuOHPo6cUDVm0N2PEAcIANNgMEWRU4qs2YRzy8M63ZceErgAB6xJDeGIUMj6PRVd0ByJkRW6_Ug0l8g5Jeey9bl5ZFJgsIEiCR-MEHjLDQPxzSst0yI8A-gQKYvMoIIwa7JD0leRhzJEPKqbwbYywQrTOWjXBSiZSin6J27345XLp95if_dYKyoXcg18qgNxNNFCDV91-s0ytGQlvgmkqAfwwgM33yLWCUlxwioYeBsLxheN0MLaBWdWgpf6oToB7viCcm3jjm4NmP-bah2ANVBwEDuBBnyA0u_NuZcWzX-fqZw7GhrrGmiC0UoPG5tzpLTmXk5DjmJ7xVy5Hefx7ySO44iKOkrmDFw5yHf0v5SAYKMHTeH5LpeYNDNeO6gaLetKeoURqwMDe_o6BrdROEvDKY9NCx1zLtUfEefCnpapIfh7XR6tzoA6V1KX3WOdJWV-35pcwyGHEqYigqmag7O16iGzV4hosqPvRRsaMrB6kRje9CvtnOTDuLKEqBbtQGYkEmACsZ_l5eKqS_TnLMAwZ8BY_UB1aOEaq8EJywf4eS9BOfLL1Ke3BcM2IDM6cgxVbcq6fSEGhJZLuw1u2&pr=13%3AaAc4uAAAAAAWtAkKl6FHttCPeRShDohk5IBuzw&cid=CAQSnAEA2absswlrJQTigmVzqAZwQZuNmYObK8DKbLNtEA-EU0JMmQBPF0IsUMb4_JYbzpS07S0ZSunmd9gtxLKHHHlMa7qXcr8VweX4jCKPGxEtHREIWWnINbjMlb4pROEjumlilvSPhlO14rzbVKF3f2Xs9YjMsa7dM1H8qEO-DRPbHhmfe1_W8v9dI3813uvrJqR0LshltE8YZLkbY_QYAQ&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=76&iif=1&cor=8238842240007621000&adk=187019820&idt=126&cac=0&dtd=67

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

7372199ce796968df90a99b150da577ba736ac1e948ad50f046419810caf955d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 45843
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET

cs
cs.lkqd.net/ Frame 1ED3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm
https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESED0sRKHLqCqwo5IrzBMcVAw&google_cver=1

0
0

GET cs
cs.lkqd.net/ Frame 1ED3 0
0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 1ED3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1

43 B
767 B

53ms
26ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKzgURDY1HwYvZ-dswIwAQ&v=APEucNWRTDnlLu2nDV2fRe53VZX-rR1LOQst9JDpuvqUFhBNe2af23_Lu8tz9Qaz7VeSNfLVMkvgB7zZuu95Ug5aK5FCm08gJw
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uHzfJPmYBd9xMbpzwr3P6aPUc%2FCtHfKlssJFZkwdk6NHLKvkbST5W%2BBHZqzuvw9hXAcNOWNt7swRIUk6Tjy%2BVXOnAg6CHdsRBi%2FnKiJ9xQGZ11ylI9zrHShraPt30OiM%2BNQhHCqDC7H0sg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a243bf92394-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 1ED3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAc4t9HM6fIAG3seAIGVtgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1

43 B
767 B

25ms
24ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKzgURDY1HwYvZ-dswIwAQ&v=APEucNWRTDnlLu2nDV2fRe53VZX-rR1LOQst9JDpuvqUFhBNe2af23_Lu8tz9Qaz7VeSNfLVMkvgB7zZuu95Ug5aK5FCm08gJw
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8%2FRnJiB5WuaI7epCJ0JZ9Xa2yzLH%2FlLm%2BlBgyGhrqYD8f83usA5go0%2F3ALXCyfBkQ4%2FEjX%2BSlf1Hlelt9qOjXju4EBy5ZNruaK%2Fn6SKu1meHksmgoGHfdcJnfsShmfeAChsyiE0vGCUUlw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a240bec2394-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdqig1gR1JXzv0GAFYTSfM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Tue, 22 Apr 2025 06:35:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 483ms
480ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Resource Hash

ae56d2f1401d9208e8787baa471b06516790faa3f5e9c233119990278f5ecf96

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: application/json
vary: Origin

POST
H3 200 7b7478376a32149e0ef75ada356d67adc1805909ace735fc39cccfd607efe15b80 Show response
faucetfoot.com/post/ 295 B
319 B 62ms
38ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/post/7b7478376a32149e0ef75ada356d67adc1805909ace735fc39cccfd607efe15b80

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/scripts/a00a397fe29b50405ffa5e07972fb7922f27e951f886ecc5

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

83c274d346b3dd798411a388f0266e418d47fa3470f262f3ac9ba2d06755347f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-spot-p3zp.gce-us-east1, 1.1 google
expires: Tue, 22 Apr 2025 06:35:35 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/2421240/86279845/ Frame AB2E 310 KB
90 KB 369ms
260ms Script
application/javascript 52.3.75.71
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/2421240/86279845/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://paint.toys/oil
Requested by: Host: qwxz.lixiuding.com
URL: https://qwxz.lixiuding.com/bvrelgudarzvufhvphbgeyyhtllsayRYmd6RjlSRWJaeGI4WTVyeUdGRW4tMjY1OS0yNjcyMzM5Ny0xMDI1MDI3ZS0zNzUwLVFISGt3TGlobUlGdVBxSDdxdElj/18xl3u2et4cpy9rynfvbxqxgjtzeb6ur3/uzxicn/eftsv4r7axcku
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.3.75.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-75-71.compute-1.amazonaws.com
Software: /
Resource Hash: 851c01e5355e5f934b4a70b5a755cc75666514cc42ff237f7931ba75b3317e4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT
access-control-allow-origin: fw.adsafeprotected.com
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: application/javascript;charset=utf-8
vary: accept-encoding

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame AB2E 117 KB
41 KB 309ms
17ms Script
text/javascript 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 5145
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Wed, 23 Apr 2025 05:09:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 05:09:52 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250421/r20110914/elements/html/ Frame AB2E 12 KB
4 KB 15ms
14ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250421/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzKchzyytlOG4u0JaebvNHS_CkpIPVsBbpTBwjBC8lVXlKsEsFFrZX-laGS7NgEZw0G2z_xX3UcFkjEYYwJ6p4ulKXmY4maUPs5vCeTeD8wbiyey7hs2HKT22kBj1O24qbpiwlF9zw24R4B4MIhw7VfgHMZNyvWOx0AYHUF2esNPaI-p8K8B8lOa5xmQkrbt8YrqpaxXlBV1LoDC_e99zkZpGJIIkzEuW_YRPFJfqqeLRw-lCm8Lg3m8SgBj24GvYj1fipgdEmYM9T_bTMzGpmU93fNw&dbm_d=AKAmf-DhOPz4jXYvswYkTHZMktcBJ5fcMSs2qkhsudXu_DdSJCHxzdWR7r507k_28JyH3C06nyC4iXqrNcE0zqs-HMguYPAmBc9YKgFaH1_CMuJieqzlzLOfg2xu02POwFbTGIXdPI30PuaxjVwzA8WyjbR80ZERKI0VoIGEzbzcUV_PyfZpRQJI5VUTvoNGetNdve_p3HSgt91X1yD3Fd4MWj5auFsoLibJtZCmv590xNIhf_M8HrEdqerIIrlR6lM0KB-mmzFPjlLHINmANFM1LVdL5NKGxF66yfPAa8E-IT3KsLNePbh1RW_N2vzBzWQaTTRhdoqT7lOk13JbNqq-Kdvh4kDH0ZaLVUlILcNfbOtsICkcz98ZlQK0B441oPgWvY84kH3vMRSu6PpX48OHrfVF-Np_d3pjx4UrfeUrwcVGx_KHNqRR1dldFDpKjy6TksCN4GwtX60Exr3ESeMdvK-ZRAGbhiOHh4u9FSZE3pxP5C6L0uI6GavXN8Ypo4ndfeE4w3oQQIU9_w1jGQDLoAZ3EscdkVuJfNtRsdCKuC52twPetnc62e3ujb8u7FTUiGIAGzIfvw4PiPv0MGByBZReOV0e-n-OJ-XpW3n4-acMsP7N_1KN_cN14OYnqcB6JsA4267mNDOVdtOPzaddgXCicalZfASOAebFwQMtx0w7vIRc9drj8isMKmonsKlp6_mN5iqSibm69DNeqBbwY7YkiiSp_hPGugszKtDhoqY0_U88zhV6ORvCFMWGtmjn0effSGb97lPhf43pVDpzxRr_pGbtm84HVIxDUx8C5EF9C7VS0sX-Tflr0xA_QJLcmUkXe-4CAGXQa9-150kxnMLdLFSRdRyhLi9M5FBC_rJ4crs_0LRcXDvn8IH_O6iuDSwCnoT8p0GIUvzHmxiL-2ZvrABlc3fgsCU_9gAgjUtLHtR5aIscrcFyx0rCC8EL4zEpEAz8u_IYCV2seFj-6_i4SovRAQahyk0-q92pB2tHUHL-vPVKkBKNrW-kqpBBvVllmy3taoeQic65tqmLA_ov3ZWmTfi0GGfGXko1kVXmalzzZ8CO8i7x0lc008bDTaMcVnXWgeeFA5jSLozI3OwQ809mulpxF5s5xYs4AGnXKx7fk3wzgf2MKYYZjbPyO2gQXYki2RTbWjXOBBl3rp1xlV0sx0Qr-cmnObTkxKd4x3zSmziSN_t8V1QTw_7KhXlqJByKrInuCxAzHsHafKwyibBZM4M2ixcdHbcRNgm3awqE5hF5rdtavqipgIo1rAI61haN2dFXHxajouUHzPV_AKqgdnHmRTI2VUsLfJg_7IRUV1wrDcSEqhSTivYLHvsTHRFfmCTv0GlqY6UfQvS6DTyQHo1C7JEE072MB0aUzL6N7N4gzxq-eZd8ikMioz28gDAK-GTauh4qFLwsscLnIk6D1RHmbe0M05buEiUWztDkaBasgTTNOiU_f5yFpNbpJbfRBUz-NkoYFvMdcOYXw0wW_LqTfPRSZjjLtzgBMig2Vh9HRqGfWPrAvMQhUiikFNLqZndKE1DAKZ9lMPG-IiwrgluQ_53U6792Nyknv4_jPwdGc4MP8evwthkZvYUOZC0Vdn9imTaowNGZT9kKyY0mJcB2keZ8dmO_xb3oHfWg_veG7ZK66aex4edqrZGjlCjgiJU-I2_IFu0_3qv9QFWBad5ScyvHlitWXj8g0gofboFnr6TF03GhIZluN0x1hjl0i1fz_33_X-0q5gkZ1JINt6IepVgbwQR1L-89GCrs_LHKVxeNinEiE4u0CtbRV5F-OA48F-7MBgutp0bg1I7UjJH3CHuGUD39t3BwyODy1_d_uNP-RJkkc2zWQJHaQMghs0qy80rTpvZ5-lm-PbtDKZuwz9xeQw05wU6e7r3JrUzMkknNBJl7QvdqmoMuEKo7KOJZPBFak2VWNAh-Lm1zu4ZBF9qBlVo8cjQSAN765FFy5vCIXX2mOozIJrjag5d5qkTglw3-zBnuFaDFddQqxzZvGHaeIaU-WGVAxQoCzE98gvHRgC_IiWzOUrIi7kv8UY1YuUZN0qty6wBxLyimkSuG2Vc0x4DADIxS-n6nu4mclxg_1PWS-fzq8cLeCoNZWcALqtrZUeRh3Yk77CqJUFZAzxHbo2xNCaE2FTAJYwJFZcMGeX3rNbUzxcNgWGXMlGH0n9Y7-_2RufcHldzOEySxMkHC1GdQ57udKuOXSePGE_v6NpMxPQLq4kWlfFOjxeydeX3OMVpLmLybvAB5sLLnm1z5iZbXT9rzPqF9cTfh2pKHtmyKBDRPb0IP8elk9PvykZQFiIN-akw_a5W1yCrqMUXY3rDE4U_6v1eo4DTr6YArB1Xh7avyiUFtXkZx_cVdxjI1cmVuCdux3DQYWGfSKCeVHeiv-bgfR1AqDW2ILdbQvqg1QlaVzjh4dwPKQy1WF0QyqkYJWEi37tMwnZCnGosbq3A1LXX-XOIuLhusrOjFr9Kq6Wii8H_77pUw_UZa4AayS0_zId98S97eDH1iFWxnukGmG5WzMGXUPUHQIFX5YHf-IBvfv2qiaimYE2fd9TJleueyxCtbAP7AeNpGB0XZVrn0b40U26Hn-o89iPDax-Mf6_XRZQ2Bon2PrpGz_-ZjcwmX2EalRpNA0Gf02vXXBWjAzg9EqhqupHpvA9Rhot9mGKaPQ5BS41DWgJ1wLo27bASXKOrZ9j-MzZIPSpKeMYtt92uzgHBNUBvVNjQhL7Sf9xNf4NhqY4HYAz_O_GOWPvlmHaInLz6xZiDAscMSv9JL1lLkF7_qFSC7WZUUgAj5j9ttDyoxtrjMYpOkgGsujM36dK6i7a2TQmXM8nU4I-iOqjo9vryPDafZUl1CcLutpDxKPPwZMcv2SxW_NxUFK-ulari37XC_gnww9bjmiEaucfTRjYof0bUpEBBfvRgRirLO6RmicreKwTBmpaERDwPZbVicXKoc9bGPxhyPIAAhcsOzuoICRm85UVY_BkuSoGUFZlXbL0WEkttc3KZoy2tAZAnypiLM9QXHtSq5wXNRh4cY8qx8RfZaLnqpNzMja7m0zMt-7JvsE53o-j71Mz0CIoYV-3LSuKwcz68Nf7nlaAwQkoGG7tdCSyiuruwNsblmhdhf1TGcA1ec_pljRidH8giR-0xj-qQqZQVcbZzbgtwtqb8YLjTTAMIzp4TmclDrzuYrRmjbNjAt8xuqioV-jgpPvuhhGK30rsT8zFgz6j4rtkek_t3NZCCj08l8UuItkUaDdFKfWHn8xkFafqQXGNZmBGwf7NCREZ9yrfB5IslMCgf71kYAmnlPfk-XFe_UZvUwAt3Ddlz9zarn7CaEYBUeQcDQcWdpDGO9nEn--kzImg6ReVMvVCLNK_36Zs60PdzDJVHp6CRx6QR0FWyTMtZ_JiKUMMyjdo4N6f2jZ_nPqvoAvggYuOHPo6cUDVm0N2PEAcIANNgMEWRU4qs2YRzy8M63ZceErgAB6xJDeGIUMj6PRVd0ByJkRW6_Ug0l8g5Jeey9bl5ZFJgsIEiCR-MEHjLDQPxzSst0yI8A-gQKYvMoIIwa7JD0leRhzJEPKqbwbYywQrTOWjXBSiZSin6J27345XLp95if_dYKyoXcg18qgNxNNFCDV91-s0ytGQlvgmkqAfwwgM33yLWCUlxwioYeBsLxheN0MLaBWdWgpf6oToB7viCcm3jjm4NmP-bah2ANVBwEDuBBnyA0u_NuZcWzX-fqZw7GhrrGmiC0UoPG5tzpLTmXk5DjmJ7xVy5Hefx7ySO44iKOkrmDFw5yHf0v5SAYKMHTeH5LpeYNDNeO6gaLetKeoURqwMDe_o6BrdROEvDKY9NCx1zLtUfEefCnpapIfh7XR6tzoA6V1KX3WOdJWV-35pcwyGHEqYigqmag7O16iGzV4hosqPvRRsaMrB6kRje9CvtnOTDuLKEqBbtQGYkEmACsZ_l5eKqS_TnLMAwZ8BY_UB1aOEaq8EJywf4eS9BOfLL1Ke3BcM2IDM6cgxVbcq6fSEGhJZLuw1u2&pr=13%3AaAc4uAAAAAAWtAkKl6FHttCPeRShDohk5IBuzw&cid=CAQSnAEA2absswlrJQTigmVzqAZwQZuNmYObK8DKbLNtEA-EU0JMmQBPF0IsUMb4_JYbzpS07S0ZSunmd9gtxLKHHHlMa7qXcr8VweX4jCKPGxEtHREIWWnINbjMlb4pROEjumlilvSPhlO14rzbVKF3f2Xs9YjMsa7dM1H8qEO-DRPbHhmfe1_W8v9dI3813uvrJqR0LshltE8YZLkbY_QYAQ&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=76&iif=1&cor=8238842240007621000&adk=187019820&idt=126&cac=0&dtd=67

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ec0d4a8b73c1b311d91ec21907b35ed43be697059740b70571f5a8abe40a96a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 8593911155552589720
age: 4413
x-content-type-options: nosniff
expires: Tue, 06 May 2025 05:22:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 22 Apr 2025 05:22:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 4395
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250421/r20110914/ Frame AB2E 28 KB
11 KB 19ms
15ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250421/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f23894318762b36821c3923f3c1ca87bdf0b2c9902892a77924311e9a554da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 15485095301559849764
age: 4412
x-content-type-options: nosniff
expires: Tue, 06 May 2025 05:22:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 22 Apr 2025 05:22:04 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10746
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame AB2E 41 KB
14 KB 17ms
13ms Script
text/javascript 64.233.180.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 842
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 07:11:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:21:34 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame E126 2 KB
1 KB 33ms
32ms Document
text/html 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Requested by: Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad1cf01dc4e07690db97248abf4a41d45cedd26ef4e1cac591775c0666e5aa7f

Request headers

Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93431a242bf52394-EWR
content-encoding: br
content-type: text/html
date: Tue, 22 Apr 2025 06:35:37 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LhrYZQtpGJ5qNHZqkM7XRZgEqm2BzTy9pIO0nU1Gd6T%2B4Akuvqbz7NTuOwVUCYyD0If3dZSXdWU8%2FKGD3cKZN81pGmfoREb0cw8%2Fl%2BFua30zSco04mvnaOP7Qkt1n76HeYYGn8%2BID3VmPw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 613A 1 KB
643 B 19ms
14ms Document
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 2795
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 05:49:01 GMT
etag: 48472445140208031
expires: Wed, 23 Apr 2025 05:49:01 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
0 83ms
79ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
0 142ms
138ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame AB2E 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1bf74d86659efd0fcdb04b4d9ca735a4ac1832881f216ab4dd47a05b2fa69915

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
0 141ms
138ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-156-107.compute-1.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame E126
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB&gpp=&gpp_sid=&dcc=t

43 B
855 B

37ms
35ms

Image
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0

Protocol

HTTP/1.1

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: BGEBMFWXRXHMG83VHS2G
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Tue, 22 Apr 2025 06:35:37 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB&gpp=&gpp_sid=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: CARRKBY566YJBXQ2ZQXF
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Tue, 22 Apr 2025 06:35:37 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame E126 43 B
519 B 318ms
316ms Image
image/gif 54.197.233.198
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.197.233.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-197-233-198.compute-1.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E126
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AADRYk7QDnEAABngXp_QgA&expiration=1746513337

43 B
769 B

31ms
31ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AADRYk7QDnEAABngXp_QgA&expiration=1746513337
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MQCvBZjZ%2FJidb3wjlTOY1EgScdrTQRsrA%2FV55%2BxBaBOgJAoGf9xh6R%2BUYRBDlvWIuS6pEtlTQP6fM5UAmgqjFWgZNoZgXx2wq1PUdMXIrx%2BwPo0zku2lTzzHvWV8RRr8doz0O%2BsG3hUDSw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a27bccf2394-EWR
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AADRYk7QDnEAABngXp_QgA&expiration=1746513337
Content-Length: 0
Date: Tue, 22 Apr 2025 06:35:37 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E126
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&__qcmcs=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=IP-VpCX_x6o79J2hIaOIq3Oix6A7_5HxJqYKiV4n

43 B
761 B

30ms
28ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=IP-VpCX_x6o79J2hIaOIq3Oix6A7_5HxJqYKiV4n
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Amm5FAopPxYQtYstJCyNpI4wjqUt3NTVHA7tX6AHDBYQCqIiTnzu42QKxPEcLylMC5pywATdRtL3LCEK8bWhla%2B6JWRQ0WIMWNy71vzXMeS1u59nguYuBLUSdZMpJV9h8BedgowTGu72LA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a268c8c2394-EWR
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=86400
cache-control: private, no-store, proxy-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=IP-VpCX_x6o79J2hIaOIq3Oix6A7_5HxJqYKiV4n
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT

GET
H2

200

sync
odr.mookie1.com/t/v2/ Frame E126
Redirect Chain

https://x.bidswitch.net/sync?ssp=index
https://x.bidswitch.net/ul_cb/sync?ssp=index
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&ssp=index&gdpr=&gdpr_consent=

43 B
632 B

199ms
62ms

Image
image/gif

35.190.90.30
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&ssp=index&gdpr=&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Protocol: H2
Server: 35.190.90.30 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 30.90.190.35.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-application-context: application
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-length: 43
content-type: image/gif;charset=UTF-8
server: Apache

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&ssp=index&gdpr=&gdpr_consent=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 06:35:37 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E126
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?puid=aAc4t9HM6fIAG3seAIGVtgAA%263670&cb=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fexternal_user_id%3D_ZUID_&gdpr=&gdpr_consent=&us_privacy=
https://b1sync.outbrain.com/usersync/index/?cb=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fexternal_user_id%3D_ZUID_&gdpr=&gdpr_consent=&puid=aAc4t9HM6fIAG3seAIGVtgAA%263670&s=2&us_privacy=
https://b1sync.zemanta.com/usersync/index/?cb=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fexternal_user_id%3D_ZUID_&gdpr=&gdpr_consent=&obuid=ecab3dfd-fd85-45d2-8bd0-9096948e0b1d&puid=aAc4t9HM6...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=ecab3dfd-fd85-45d2-8bd0-9096948e0b1d&puid=aAc4t9HM6fIAG3seAIGVtgAA&3670

43 B
775 B

28ms
26ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=ecab3dfd-fd85-45d2-8bd0-9096948e0b1d&puid=aAc4t9HM6fIAG3seAIGVtgAA&3670
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y4RCQrvGe0lwuKIV%2FTvVe9dVX53ozPhr%2FvSKJJXCFJ93BSqczA6ax6WX1SqW2EGJARmwWG982mxal%2BnyzI5Ti%2B6%2FRx9sDV3rWOKKf6P%2F1Wu%2BUJcHfnX%2BOP4KTCxsPTD8D%2BwBm%2FCb5MOFtw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a27ccd42394-EWR
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=ecab3dfd-fd85-45d2-8bd0-9096948e0b1d&puid=aAc4t9HM6fIAG3seAIGVtgAA&3670
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 174
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/html; charset=utf-8

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E126
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE
https://cm.adgrx.com/bridge.gif?AG_PID=casale
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=005b6661-1f44-11f0-ac7e-27c9ee55f825

43 B
763 B

24ms
23ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=005b6661-1f44-11f0-ac7e-27c9ee55f825
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ke8lr9axPsaUdQmVH3A2sbW1u9bCUfKPcD4ixEvc8Vy%2BwIzXRbIF00AvsCogK6BpJVW9hiJPDiDmOWKVTwXIaTSVaY6m6bUQO9vtDIRacjaZS2R%2BbW7QNHVGuSCUwpX4Q9NE%2Fpvibnt7Mw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a269c952394-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: max-age=0, private, must-revalidate, no-cache, no-store, must-revalidate, proxy-revalidate
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=005b6661-1f44-11f0-ac7e-27c9ee55f825
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 23 Sep 2004 17:42:04 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
P3P: CP="NOI OTC OTP OUR NOR"
Date: Tue, 22 Apr 2025 06:35:37 GMT
Content-Type: image/gif
vary: accept-encoding

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E126
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.ca...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662157672448392

43 B
766 B

33ms
31ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662157672448392
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9rz5u4nPbr2TSXqr9UOFkGeGkm7Q1%2F%2BWi5l3Pj9RMWCWcKHsz6LxWVyjCyx2n8sCas7vz08E9Uq9YqScb%2FurRTpgf8uJ%2FBdhVukzZGwgS55%2F1J5w5FCZiSJ1SxyYxchnKI1jaNUKJ6Op9A%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93431a2a6d682394-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, private
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662157672448392
cf-cache-status: DYNAMIC
pragma: no-cache
x-function: 209
cf-ray: 93431a29d86bfd86-EWR
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-reuse-index: 217
p3p: CP="NOI DEVo TAIa OUR BUS"
server-timing: cfExtPri
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/html
server: cloudflare
priority: u=3,i

GET
H2 200 htw-pixel.gif
js-sec.indexww.com/ht/ Frame E126 43 B
234 B 51ms
34ms Image
image/gif 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://js-sec.indexww.com/ht/htw-pixel.gif?aAc4t9HM6fIAG3seAIGVtgAADlYAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: public, max-age=14400
cf-cache-status: HIT
etag: "da1f1d-2b-546dc3a097100"
age: 926
cf-ray: 93431a251a2b0f73-EWR
expires: Tue, 22 Apr 2025 10:35:37 GMT
accept-ranges: bytes
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Tue, 22 Apr 2025 06:35:37 GMT
edge-control: cache-maxage=1h
content-type: image/gif
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9AEC 38 KB
13 KB 28ms
27ms Document
text/html 64.233.180.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-156-107.compute-1.amazonaws.com

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 931
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Apr 2025 06:20:06 GMT
expires: Tue, 22 Apr 2025 07:10:06 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 8EF5
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&gdpr=0&gdpr_consent=

35 B
591 B

51ms
51ms

Document
image/gif

185.167.164.53
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.53 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Tue, 22 Apr 2025 06:35:37 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 8F18
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=04786EE4-3EF3-41F1-966F-7BE00608AD0E&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=04786EE4-3EF3-41F1-966F-7BE00608AD0E&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

92ms
62ms

Document
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=04786EE4-3EF3-41F1-966F-7BE00608AD0E&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 22 Apr 2025 06:35:37 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: DSR92TVRSTSSEGJ0B7G3

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 22 Apr 2025 06:35:37 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=04786EE4-3EF3-41F1-966F-7BE00608AD0E&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 4HYR0YEQZ3TF3B4BJCS9

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9E40
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4161161628424474210&gdpr=0&gdpr_consent=

42 B
218 B

78ms
23ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4161161628424474210&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 45c943d2-b654-42bd-b76a-ef6c5b6df3b2
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4161161628424474210&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 756F 0
339 B 132ms
48ms Document
image/gif 169.197.150.7
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 302A
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=kjsBoStBXRhQoOMu4mDsNJfzjY4&gdpr=0&gdpr_consent=

42 B
530 B

81ms
23ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=kjsBoStBXRhQoOMu4mDsNJfzjY4&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Tue, 22 Apr 2025 06:35:37 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=kjsBoStBXRhQoOMu4mDsNJfzjY4&gdpr=0&gdpr_consent=

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 1753
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
171 B

28ms
23ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAc4uQAAN6IGjwBT
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2652
cache-control: no-cache
content-length: 85
content-type: image/png
date: Tue, 22 Apr 2025 06:35:37 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 2222
x-robots-tag: noindex
x-served-by: cache-ewr-kewr1740086-EWR
x-timer: S1745303737.241242,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAc4uQAAN6IGjwBT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-ewr-kewr1740086-EWR
x-timer: S1745303737.216451,VS0,VE6

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame BCC1
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968625810713231110

42 B
194 B

15ms
15ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968625810713231110
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Tue, 22 Apr 2025 06:35:37 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968625810713231110
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET

redir
rtb-csync.smartadserver.com/ Frame 0E5A
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEUllrN1FEbkVBQUJuZ1hwX1FnQQ&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AADRYk7QDnEAABngXp_QgA&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_par...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AADRYk7QDnEAABngXp_QgA&pid=558502&do=add&gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AADRYk7QDnEAABngXp_QgA&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...

0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9B55
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&gdpr=0&gdpr_consent=&gdpr_pd=
https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_23887c9c-cb6c-4c27-89b8-8c94675415bd&bsw_param=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&expires=10&gdpr=0&gdpr_consent=&gdpr_pd=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
203 B

10ms
9ms

Document
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c4cdc4ff-ddb7-4d9f-8ed9-69cca8fc5558&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 0670
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=85778673-5a48-4d3c-b507-a27375b6e274&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=04786EE4-3EF3-41F1-966F-7BE00608AD0E

42 B
493 B

15ms
14ms

Document
image/gif

54.82.72.169
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=04786EE4-3EF3-41F1-966F-7BE00608AD0E
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.72.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-72-169.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Tue, 22 Apr 2025 06:35:37 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Tue, 22 Apr 2025 06:35:37 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=04786EE4-3EF3-41F1-966F-7BE00608AD0E
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 76BF
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=5smlBuPJ9wj9wq0D55W4CbWU9wL9yaFT4JCFu9Uk

42 B
342 B

55ms
53ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=5smlBuPJ9wj9wq0D55W4CbWU9wL9yaFT4JCFu9Uk
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-store, proxy-revalidate
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=5smlBuPJ9wj9wq0D55W4CbWU9wL9yaFT4JCFu9Uk
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3D87
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=0056a9fd-1f44-11f0-8795-0a7442d744fc

42 B
244 B

58ms
55ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=0056a9fd-1f44-11f0-8795-0a7442d744fc
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 22 Apr 2025 06:35:37 GMT
Expires: Thu, 23 Sep 2004 17:42:04 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=0056a9fd-1f44-11f0-8795-0a7442d744fc
P3P: CP="NOI OTC OTP OUR NOR"
Pragma: no-cache
cache-control: max-age=0, private, must-revalidate
vary: accept-encoding

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame BC69
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:55c76807-38ba-4d00-a4e7-ef88d5f876fc&gdpr=0&gdpr_consent=

42 B
210 B

10ms
10ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:55c76807-38ba-4d00-a4e7-ef88d5f876fc&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Date: Tue, 22 Apr 2025 06:35:37 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Referrer-Policy: strict-origin
Server: MT3 1797 8af0415 master ord ord-pixel-x6 config_version:"150"
Strict-Transport-Security: 31536000
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
X-XSS-Protection: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:55c76807-38ba-4d00-a4e7-ef88d5f876fc&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C7E2
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw

42 B
95 B

12ms
10ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 93431a29d86cfd86-EWR
content-type: text/html
date: Tue, 22 Apr 2025 06:35:37 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-function: 209
x-reuse-index: 167

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame E897
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU7fed9b5571914b6b8141be3d8172bda9

42 B
315 B

10ms
9ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU7fed9b5571914b6b8141be3d8172bda9
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU7fed9b5571914b6b8141be3d8172bda9
pragma: no-cache
server: Tengine

GET pubmatic
ad.mrtnsvr.com/sync/ Frame C0B6 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B221
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=8Z7X5Gy8HBirCPecXcWnBYi5i-f4gtlU6v-E7D89p-Y&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&g...

42 B
348 B

10ms
9ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=8Z7X5Gy8HBirCPecXcWnBYi5i-f4gtlU6v-E7D89p-Y&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 22 Apr 2025 06:35:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT Tue, 22 Apr 2025 06:35:37 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=8Z7X5Gy8HBirCPecXcWnBYi5i-f4gtlU6v-E7D89p-Y&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame 2CE7 0
181 B 99ms
42ms Document
text/html 143.244.220.80
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.244.220.80 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Tue, 22 Apr 2025 06:35:36 GMT

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 172F
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=04786EE4-3EF3-41F1-966F-7BE00608AD0E
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=4e19c153-0989-4f15-8a41-ee3ceb1d13aa

42 B
319 B

43ms
37ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=4e19c153-0989-4f15-8a41-ee3ceb1d13aa
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=4e19c153-0989-4f15-8a41-ee3ceb1d13aa
pragma: no-cache
x-forwarded-for: 151.243.141.142
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200
OK

/
bidberry.net/ Frame 172F
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=04786EE4-3EF3-41F1-966F-7BE00608AD0E&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-gMB7o4dE2pQDSfJE0c2LD54WGpfaLkB42g--~A&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&icm&gdpr=0&gdpr_consent=&cver
https://bidberry.net/?partner=1&mapped=bc0d30d9371a24f6&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/map/c=14544/tp=BIDB/gdpr=0/gdpr_consent=?https%3A%2F%2Fbidberry.net%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D%26redirect%3D
https://bidberry.net/?partner=104&icm&cver&mapped=dd1a4c2540dc332440e7a408c1ff586f&gdpr=0&redirect=

35 B
245 B

90ms
89ms

Image
image/gif

57.129.39.243
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://bidberry.net/?partner=104&icm&cver&mapped=dd1a4c2540dc332440e7a408c1ff586f&gdpr=0&redirect=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 57.129.39.243 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3235992.ip-57-129-39.eu
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-type: image/gif
content-length: 35

Redirect headers

expires: 0
cache-control: no-cache
location: https://bidberry.net/?partner=104&icm&cver&mapped=dd1a4c2540dc332440e7a408c1ff586f&gdpr=0&redirect=
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Tue, 22 Apr 2025 06:35:38 GMT
pragma: no-cache

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame 172F
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=04786EE4-3EF3-41F1-966F-7BE00608AD0E&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=04786EE4-3EF3-41F1-966F-7BE00608AD0E&sInitiator=external&gdpr=0&gdpr_consent=

42 B
604 B

30ms
30ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=04786EE4-3EF3-41F1-966F-7BE00608AD0E&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 15
Pragma: no-cache
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Tue, 22 Apr 2025 06:35:37 GMT
Content-Length: 42
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=04786EE4-3EF3-41F1-966F-7BE00608AD0E&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 4
Pragma: no-cache
Connection: Keep-Alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Tue, 22 Apr 2025 06:35:37 GMT
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDQ3ODZFRTQtM0VGMy00MUYxLTk2NkYtN0JFMDA2MDhBRDBF&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDkx4WrrKyUQzyALy5P80oA&google_cver=1

42 B
97 B

91ms
45ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDkx4WrrKyUQzyALy5P80oA&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDkx4WrrKyUQzyALy5P80oA&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 172F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BHhu5D7zQfGWb3vgBgitDg%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEEiAaR_UF8M9YwppeUOY6_s&google_cver=1

20 KB
20 KB

32ms
15ms

Image
text/html

23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEEiAaR_UF8M9YwppeUOY6_s&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=88628
content-encoding: gzip
expires: Wed, 23 Apr 2025 07:12:45 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Tue, 22 Apr 2025 06:35:37 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEEiAaR_UF8M9YwppeUOY6_s&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDkx4WrrKyUQzyALy5P80oA&google_cver=1

42 B
300 B

43ms
18ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDkx4WrrKyUQzyALy5P80oA&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDkx4WrrKyUQzyALy5P80oA&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:15A5538913C8445A91057981521A2612

42 B
245 B

12ms
10ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:15A5538913C8445A91057981521A2612
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:15A5538913C8445A91057981521A2612
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 21 Apr 2025 06:35:37 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&gdpr=0&gdpr_consent=

42 B
314 B

52ms
26ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&gdpr=0&gdpr_consent=
content-length: 355
date: Tue, 22 Apr 2025 06:35:37 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-TGRhHuJE2uWpsa4tlJa4JycdCDiLKbk-~A&gdpr=0

0
260 B

247ms
65ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-TGRhHuJE2uWpsa4tlJa4JycdCDiLKbk-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 00:29:39 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-TGRhHuJE2uWpsa4tlJa4JycdCDiLKbk-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/html
server: ATS

GET
H2 200 04786EE4-3EF3-41F1-966F-7BE00608AD0E
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 172F 43 B
519 B 211ms
174ms Image
image/gif 54.197.233.198
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/04786EE4-3EF3-41F1-966F-7BE00608AD0E?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.197.233.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-197-233-198.compute-1.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e1488854-f7cf-47f3-892f-efd0e3df6b9c&gdpr=0&gdpr_consent=

1 B
257 B

32ms
29ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e1488854-f7cf-47f3-892f-efd0e3df6b9c&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: a7b3f8bd-c3ff-4cc2-a680-2be564dd6253
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e1488854-f7cf-47f3-892f-efd0e3df6b9c&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Tue, 22 Apr 2025 06:35:37 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&gdpr=0&gdpr_consent=

42 B
539 B

70ms
17ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=3fc33270-4fe1-4886-a226-c967a24f0222-680738b9-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT
server: A

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 172F 0
163 B 97ms
47ms Image
text/plain 35.153.242.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.242.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-242-12.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Tue, 22 Apr 2025 06:35:37 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=2f7a1b644dad13cf&is_secure=true&networkId=17100&version=1&nuid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAE2RKMq6_qDgJJ_94nAQEBAQEBAQCXXTSVvQEBAQEBAQEB&expiration=1745390137&nuid=04786EE4-3EF3-41...

42 B
373 B

14ms
12ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAE2RKMq6_qDgJJ_94nAQEBAQEBAQCXXTSVvQEBAQEBAQEB&expiration=1745390137&nuid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAE2RKMq6_qDgJJ_94nAQEBAQEBAQCXXTSVvQEBAQEBAQEB&expiration=1745390137&nuid=04786EE4-3EF3-41F1-966F-7BE00608AD0E&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
pragma: no-cache
server: nginx

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 172F
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3128279717856594852&gdpr=0&gdpr_consent=&us_privacy=

1 B
243 B

24ms
22ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3128279717856594852&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3128279717856594852&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Tue, 22 Apr 2025 06:35:27 GMT

GET sn.ashx
pmp.mxptint.net/ Frame 172F 0
0

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D725
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirectUri=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dsmart%26gdpr%3D0%26gdp...
https://elb.the-ozone-project.com/setuid?bidder=smart&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=6148392667309329377

0
686 B

38ms
37ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=smart&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=6148392667309329377
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93431a265929c33f-EWR
expires: 0
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache,no-store
location: https://elb.the-ozone-project.com/setuid?bidder=smart&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=6148392667309329377
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Tue, 22 Apr 2025 06:35:36 GMT
pragma: no-cache

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 54ms
33ms Fetch
text/html 142.251.163.154
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.154 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f154.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 613A
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESELr36AqVzHqBVXxfvNJmfvs&google_cver=1&google_push=AXcoOmSeR-yoj4cxNUD305xLzMIEYtw2ty6r8cbu7hV7_S4kyoV82EZuxniwypSoeJHV1uiM1f8kz...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSeR-yoj4cxNUD305xLzMIEYtw2ty6r8cbu7hV7_S4kyoV82EZuxniwypSoeJHV1uiM1f8kz1rq5Mux1QmZyU1DHZOi87I

170 B
188 B

48ms
45ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSeR-yoj4cxNUD305xLzMIEYtw2ty6r8cbu7hV7_S4kyoV82EZuxniwypSoeJHV1uiM1f8kz1rq5Mux1QmZyU1DHZOi87I

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSeR-yoj4cxNUD305xLzMIEYtw2ty6r8cbu7hV7_S4kyoV82EZuxniwypSoeJHV1uiM1f8kz1rq5Mux1QmZyU1DHZOi87I
x-msedge-ref: Ref A: BB09DAB5708D4654B1C13413072923CF Ref B: TEB31EDGE0309 Ref C: 2025-04-22T06:35:37Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzWDFH6eY8WcANa0sUVQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 22 Apr 2025 06:35:36 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 613A
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEM6Z1MHP_wlaDGCcTlT7yxc&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjdmNTM4ZjItNzY3ZS00OThkLTg4ZDctOTgyMjcwNWI2NGQw&google_gid=CAESEM6Z1MHP_wlaDGCcTlT7yxc&google_cver=1&google_push=AXcoOmQQ...

170 B
188 B

30ms
29ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjdmNTM4ZjItNzY3ZS00OThkLTg4ZDctOTgyMjcwNWI2NGQw&google_gid=CAESEM6Z1MHP_wlaDGCcTlT7yxc&google_cver=1&google_push=AXcoOmQQdYE9eRxA04igVYsmL37hzOZpwJfCsqOkpOb1U0apBlRBL-qESVJqqyia7mbEUtULs6x1pdvA-YGca5WDJA7XxiqP0jM

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjdmNTM4ZjItNzY3ZS00OThkLTg4ZDctOTgyMjcwNWI2NGQw&google_gid=CAESEM6Z1MHP_wlaDGCcTlT7yxc&google_cver=1&google_push=AXcoOmQQdYE9eRxA04igVYsmL37hzOZpwJfCsqOkpOb1U0apBlRBL-qESVJqqyia7mbEUtULs6x1pdvA-YGca5WDJA7XxiqP0jM
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 613A
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQpM9...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1CamlMUEZOTXV1VVJHWDk2YmNSVHFzakVGcGhtNTBtR0ZqRl9odw&google_push=AXcoOmQpM9YNRzFK55tzfXoOEo5Gy_o7Mib2oulC9_IGYW9_AO2ozgaK0_iIo7l62vId63...

170 B
188 B

27ms
27ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1CamlMUEZOTXV1VVJHWDk2YmNSVHFzakVGcGhtNTBtR0ZqRl9odw&google_push=AXcoOmQpM9YNRzFK55tzfXoOEo5Gy_o7Mib2oulC9_IGYW9_AO2ozgaK0_iIo7l62vId63U-6YNCMmVgNgM_zC4jrU6Qw4OcjdY

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1CamlMUEZOTXV1VVJHWDk2YmNSVHFzakVGcGhtNTBtR0ZqRl9odw&google_push=AXcoOmQpM9YNRzFK55tzfXoOEo5Gy_o7Mib2oulC9_IGYW9_AO2ozgaK0_iIo7l62vId63U-6YNCMmVgNgM_zC4jrU6Qw4OcjdY
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1113875
expires: Tue, 22 Apr 2025 00:00:00 GMT
x-errorlevel: 0
content-length: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Tue, 22 Apr 2025 06:35:36 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 613A
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEHp-uYHavoCBXOOG5ym29o0&google_cver=1&google_push=AXcoOmQtoQweD9HYU-93pM35xYYqNA7RhcqjoJSD1JRYAputlZodQzR1IC-nWC3435I0UbOtuIuyYM5aax9IVN6ovI...
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTQ2MzA0NzM2NDkyOTIxNjY2&google_push=AXcoOmQtoQweD9HYU-93pM35xYYqNA7RhcqjoJSD1JRYAputlZodQzR1IC-nWC3435I0UbOtuIuyYM5aax9IVN6ovIGnAOBIzQ

170 B
188 B

29ms
27ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTQ2MzA0NzM2NDkyOTIxNjY2&google_push=AXcoOmQtoQweD9HYU-93pM35xYYqNA7RhcqjoJSD1JRYAputlZodQzR1IC-nWC3435I0UbOtuIuyYM5aax9IVN6ovIGnAOBIzQ

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTQ2MzA0NzM2NDkyOTIxNjY2&google_push=AXcoOmQtoQweD9HYU-93pM35xYYqNA7RhcqjoJSD1JRYAputlZodQzR1IC-nWC3435I0UbOtuIuyYM5aax9IVN6ovIGnAOBIzQ
Content-Length: 0
Date: Tue, 22 Apr 2025 06:35:37 GMT
Server: nginx
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 613A
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAXcoOmQTMy5-35yMZ3SJjlVIuqAzMvPAw9O_V-Q-q9lHlB_cRcsUZqhIfSp1JF58zFbxncc0y-aI0fg_oe...
https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmQTMy5-35yMZ3SJjlVIuqAzMvPAw9O_V-Q-q9lHlB_cRcsUZqhIfSp1JF58zFbxncc0y-aI0fg_oegP-0v0FC0UqI2QTA&google_hm=MmFjYWI0MTctZjAzOS00YjQ...

170 B
188 B

33ms
30ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmQTMy5-35yMZ3SJjlVIuqAzMvPAw9O_V-Q-q9lHlB_cRcsUZqhIfSp1JF58zFbxncc0y-aI0fg_oegP-0v0FC0UqI2QTA&google_hm=MmFjYWI0MTctZjAzOS00YjQxLTlmYmYtYTAyYTY1OGZiN2Mw

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, private
location: https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmQTMy5-35yMZ3SJjlVIuqAzMvPAw9O_V-Q-q9lHlB_cRcsUZqhIfSp1JF58zFbxncc0y-aI0fg_oegP-0v0FC0UqI2QTA&google_hm=MmFjYWI0MTctZjAzOS00YjQxLTlmYmYtYTAyYTY1OGZiN2Mw
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Tue, 22 Apr 2025 06:35:37 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-14
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 613A
Redirect Chain

https://www.temu.com/api/adx/cm/pixel?google_gid=CAESECrV7g3JM2Tt5V3xrwuhspw&google_cver=1&google_push=AXcoOmR5i5BXISbAMVF7FF7KcpXDPx7H2KSJdfRC0qOqqqc6i3G9OULsc9Q_Hh105uh8AT5_V02dSCuJs8fvGmGJgl5So-...
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmR5i5BXISbAMVF7FF7KcpXDPx7H2KSJdfRC0qOqqqc6i3G9OULsc9Q_Hh105uh8AT5_V02dSCuJs8fvGmGJgl5So-vp_Z8&google_nid=whaleco_services_llc

170 B
188 B

32ms
30ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmR5i5BXISbAMVF7FF7KcpXDPx7H2KSJdfRC0qOqqqc6i3G9OULsc9Q_Hh105uh8AT5_V02dSCuJs8fvGmGJgl5So-vp_Z8&google_nid=whaleco_services_llc

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1745303737248|3
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmR5i5BXISbAMVF7FF7KcpXDPx7H2KSJdfRC0qOqqqc6i3G9OULsc9Q_Hh105uh8AT5_V02dSCuJs8fvGmGJgl5So-vp_Z8&google_nid=whaleco_services_llc
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1745303737248-20c7a364e957c56ea0a1b72d87fc1a54
cip: 151.243.141.142
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 613A
Redirect Chain

https://www.temu.com/api/adx/cm/pixel-google?google_gid=CAESECrV7g3JM2Tt5V3xrwuhspw&google_cver=1&google_push=AXcoOmRGA4mTYUiEOoSBGhxXa_3m0WDqct_uyk2Y7_i3mvcEww-LfcXvo8Qoh5N3BwhNt5oNSnmq1cJrV0DUpCn...
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmRGA4mTYUiEOoSBGhxXa_3m0WDqct_uyk2Y7_i3mvcEww-LfcXvo8Qoh5N3BwhNt5oNSnmq1cJrV0DUpCnX6upD0kZaA-9P&google_nid=temu_dsp2_

170 B
188 B

32ms
30ms

Image
image/png

142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmRGA4mTYUiEOoSBGhxXa_3m0WDqct_uyk2Y7_i3mvcEww-LfcXvo8Qoh5N3BwhNt5oNSnmq1cJrV0DUpCnX6upD0kZaA-9P&google_nid=temu_dsp2_

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1745303737243|3
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmRGA4mTYUiEOoSBGhxXa_3m0WDqct_uyk2Y7_i3mvcEww-LfcXvo8Qoh5N3BwhNt5oNSnmq1cJrV0DUpCnX6upD0kZaA-9P&google_nid=temu_dsp2_
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1745303737243-4c4977e750ed2eb4b0f1d34571e3d646
cip: 151.243.141.142
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
server: nginx

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 613A 0
12 B 43ms
35ms Image
text/html 142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LcJAPLKaOd3SfuFPsLdDYb-jWNMe2kYSBn2AD8umBQc1bCIKG6cpmlEmRotdg074Cya2Vk8d0

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3 200 EkdjyKrF1NmAsk7REIAGOde1tWhmsx7zcO2hk2jj3tw.js Show response
pagead2.googlesyndication.com/bg/ Frame 9AEC 54 KB
21 KB 32ms
23ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EkdjyKrF1NmAsk7REIAGOde1tWhmsx7zcO2hk2jj3tw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124763c8aac5d4d980b24ed110800639d7b5b56866b31ef370eda19368e3dedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 87495
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 06:17:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 21 Apr 2025 06:17:22 GMT
last-modified: Mon, 07 Apr 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21240
x-xss-protection: 0
server: sffe

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1981
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECxO5HDMoh8IUjkVfqxXTvo&google_cver=1

43 B
97 B

19ms
17ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECxO5HDMoh8IUjkVfqxXTvo&google_cver=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 151.243.141.142
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECxO5HDMoh8IUjkVfqxXTvo&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 1981 170 B
188 B 65ms
54ms Image
image/png 142.251.179.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MzdiMDZkZmYtMGRiOS0yN2QxLWMwZDgtMzQ3NjE4NjRiYzEy

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1981
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=1bdfbe35-c4ce-7975-d538-6ecfd2867272&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&ttd_puid=1bdfbe35-c4ce-7975-d538-6ecfd2867272&gdpr=0&gdpr_consent=

43 B
240 B

32ms
15ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&ttd_puid=1bdfbe35-c4ce-7975-d538-6ecfd2867272&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 151.243.141.142
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0&ttd_puid=1bdfbe35-c4ce-7975-d538-6ecfd2867272&gdpr=0&gdpr_consent=
content-length: 335
date: Tue, 22 Apr 2025 06:35:37 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 1981
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/8f18d871-5462-eb3c-e4ef-783a2dd1bf3b?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-Pw6TYIpE2p_MGLcVKiM3up1fCVTlQtHPE8I-~A

43 B
61 B

19ms
17ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-Pw6TYIpE2p_MGLcVKiM3up1fCVTlQtHPE8I-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 151.243.141.142
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-Pw6TYIpE2p_MGLcVKiM3up1fCVTlQtHPE8I-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 1981
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAc4uQAL-qFCUwBh

85 B
149 B

62ms
59ms

Image
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAc4uQAL-qFCUwBh
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1745303737.258909,VS0,VE0
age: 2652
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/png
x-served-by: cache-ewr-kewr1740086-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 2223

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAc4uQAL-qFCUwBh
x-timer: S1745303737.229055,VS0,VE8
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-served-by: cache-ewr-kewr1740086-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1981
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3128279717856594852&gdpr=0&gdpr_consent=&us_privacy=

43 B
97 B

58ms
56ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3128279717856594852&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 151.243.141.142
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Apr 2025 06:35:36 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3128279717856594852&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Tue, 22 Apr 2025 06:35:31 GMT

GET
DATA 200
OK truncated
/ Frame C0B6 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C0B6 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 6426 0
100 B 316ms
21ms Document
text/plain 34.236.95.104
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.95.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-95-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame AB2E 221 KB
0 0ms
0ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdd6fed4ba9bb0835886b23fac1450854f27b44b0eec1be73e0f1acf7e93d017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 2762217307112662222
age: 239
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 07:31:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 22 Apr 2025 06:31:37 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69482
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 7 KB
2 KB 33ms
15ms Document
text/html 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96b1802a4bb9240de4ae1b6eb65773f06e787672b812ad0972ca90e428d4fea5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 349375
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2187
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Apr 2025 05:32:42 GMT
expires: Sat, 18 Apr 2026 05:32:42 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame AB2E 0
0 58ms
40ms Fetch
image/png 142.251.111.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstO-SC-FnVr1qQLywNJU0YGAw87AFcCt_LMkNWAPXG8KchI4VsCdwPHw6n_WSfANbEqZWv78NOd-iXd2rb7_HOkoByXd2IvRdzqcr9Mq_whnMO9v9a8_4HFMcRhY8w9LvoffUeMASw3gVCzrb_h84l0TItx_HZzEPOQbe6pNcX4swMQnPdT8nGk9Qsy5wfRmkXjiON9tFnoEEJqdGe5k4gfEHMr3tcrYSk23ksaf01Gy8yMg5xe07voV_pUS3OkBktEAfNo3Gan2zkhT3912TEDbbEaVYJBukQVWrxOWleCaIB5TI2ox31ay527D9AfeSx7ahETsPiOB57JOEPrOpQ-rnTvwhPlJszZl5SjP2TSGkKfYftRcTxG7nkfrtK8hKR7FI0Nldc2uLSsWkz8MIb_lj83c6Taflp0EZkRgBa9hCBX1_20GTH6MuvgqqTdA0nRE3pS7gE450cTBtTHe3IgJ6NXs1ut47u93G1zqf8QDyfQnkl0SLhXFCBL7ZIr8yBSd6PRLluZR5RQTFJF_gK-vRA8S3ES1kcaxmATv_oS2qCKLQjgCunUxdB8j4szjvduCFMUmf3VmFfsa3B3b_iLCYBk0gC_sRjPSJ7ug6e-A8WdGwVdz0QpjijuOo5bLA4-hiWHYtW89PJOgM9TOnIVsNoAabjkZjlJr_izUcza920xohguBYKslkuUpbGohaOUflnRPurouK54XglggpiHSkyoJAuemCiA2Gzp5b33RtGlFUfUI4kP4uCtn0cipsRyYbpQG0XcSG6TwQxI0cX7cRMIiIba-_gC3g6p8cJ0XmCuINidjNuh3x7nFgmQfI7z1LVK6rEc7Vpuk8u6ereqytCAsF2ZtYZTj9UdjluwXmyhFxnqqm4108uBrSYaO3TRgsUXTSQ7SfghSx83yVE8DbD1hyq0f-JKxyiK6NT969W3kspA-1nDhv8Bc6tUZL0jLo_15cMJy3hZJoNZqATmO5drnbKuyWobpkPt17X4Sv1N10fMfe9q6amyTy4n0QRfndq7Fm13WJ5U0HuXwr9_oJngBgOZbCvR3IdOtkphkQSLe3oXiBxY38Qg04vcOGfphwh77oaH6gKlbYVZDekWWOHJ4vxiu5bWEyQNBf4iiAxxrJKeiX2XkJbPNc5EYG36KvMeNiZ2TUJvb9LVCZUqWn_Fl3r3C4N9umOKuL6R8Q6WW9W0_J0YBgu8hXaEdRqQS4wP9jbOwT4rpWTPYv_PqjwKOoImvFyzGlsh49U5iGMVGCLyYtwn9nQY6HE8pBGdstML716Q-4-nuK2gCEi685h3iUpxPD0qtwROJeGySZkx_obAlvK4ClJHjWoAL5Onnqi2-6XsdUaPk6bH0QDcQAu-Tdy7x8xOzNhJH8xW9oIlN9tG2U6gOzUH-a83vT4ZW0CjfGHnm2X6I3QY2ikb7Vhv8BqxlDoTmfOC9Z_W6DAkzdTYERCWlXkIIKOVF6yQGaQkG1FAt4je&sai=AMfl-YQtzEGEH_92SjsYADCM87wbo8N4nibRMesQhfcVJ1g1hPBSehZXOXGPLsZlt3hTv5iP6nmTSTVWlzei-XcVDvOM0pnI3mujIhiaLt_IpArCATT7S23vOQTjqqNitRJjo-M44iD3xF5ZlQ7HB6lI57U2NouZ8W3NcviSV73suRN85s2DlJTQR1wPDKM8YyOxXc4FT4BGokj5eCCOHgzPSGrEN7TqsXsbGrH9yjfzVJCmTDU7ksfG7GXXsprc_5KJN1rjeifEIPzdFXKkMM5zIffEi6TYGubsSMG88XZ3PJpQq0kVL3UlN9YjXaIdStiYqwe2zSWDnvW1xmKT6o6DqtXJH-Lk-RViVdxBLQBJAK3DlCcyyUgqpTEX5skHYcEiukiTrmJIvOjoMEy2FQzTRq20wQW6PdcMli5M6EjUkPPweHyIoUZvZm-YXoYMSj4OlXOZQBinixvOqH-l9AkZ8Umfc1zu6_4QqUC4xURUM2kfvcNNoLWryJT1oZZ8xmH3PUEqRb1VCVf_4MNFy6EmS10xJnNm9C44acrdHZGRU-CXgbqhknG3bSx_k-AZjSDd2D1tG-EitnKOc4KWl-I&sig=Cg0ArKJSzL3mF32AEC7vEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9tYXJjdXMuY29t&pr=13:aAc4uAAAAAAWtAkKl6FHttCPeRShDohk5IBuzw&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=417&cbvp=1&cstd=414&cisv=r20250421.83335&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 06:35:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"34772948":"0x551696ad9cd91ad60000000000000000","34772949":"0x21175227a01b9a500000000000000000","34772950":"0xf8887859762194800000000000000000"},"debug_key":"8160885162990458116","debug_reporting":true,"destination":["https://marcus.com","https://debugconversiondomain1.com","https://debugconversiondomain2.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["7845457"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["6187420"]},"max_event_level_reports":2,"priority":"0","source_event_id":"3062577650244586888"}
server: cafe

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8C18 20 KB
7 KB 24ms
23ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://elb.the-ozone-project.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=88628
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Tue, 22 Apr 2025 06:35:37 GMT
expires: Wed, 23 Apr 2025 07:12:45 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame AB2E
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/2421240/86279845/4.js?bundleId=${BUNDLE_ID}&bidurl=https://paint.toys/oil&adContainerId=brand_safety_uDgHaKWWNouToPMP8vOZ6Q0&cbFunctionName=goog_wrapCb_uDgHaKW...
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_uDgHaKWWNouToPMP8vOZ6Q0&cbFunctionName=goog_wrapCb_uDgHaKWWNouToPMP8vOZ6Q0&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpass...

1 KB
1 KB

548ms
183ms

Script
application/javascript

18.238.4.65
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_uDgHaKWWNouToPMP8vOZ6Q0&cbFunctionName=goog_wrapCb_uDgHaKWWNouToPMP8vOZ6Q0&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_160x600.js
Requested by: Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 18.238.4.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-4-65.phl51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5431bf3cd2099a41e143f4ccab7ee74d223ea22941dfd9061c5d241ed05afade

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
x-amz-version-id: h7nVr9ObBqaO20hl5.6S2_HbfF4hQIp4
etag: W/"eb639ea9c60fa52fae8bd853911ab0a9"
age: 33477
x-cache: Hit from cloudfront
x-amz-cf-id: wUBSzIwJ-4d2sYVx3rBh3NpppFddyrOiR-sSoWwK9LiBpsgX0HIR5g==
date: Mon, 21 Apr 2025 21:17:41 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 21 Apr 2025 21:17:37 GMT
x-amz-replication-status: PENDING
cache-control: max-age=604800
via: 1.1 7b2c97c3ba7e37bdd32ec314e5554c74.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL51-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

Redirect headers

cache-control: no-cache
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_uDgHaKWWNouToPMP8vOZ6Q0&cbFunctionName=goog_wrapCb_uDgHaKWWNouToPMP8vOZ6Q0&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_160x600.js
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
pragma: no-cache

GET
H2 200 sca.17.6.4.js Show response
static.adsafeprotected.com/ Frame 5029 91 KB
23 KB 618ms
182ms Script
application/javascript 18.238.4.65
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.4.js
Requested by: Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.4.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-4-65.phl51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ac42cf20760d5b0f71be7a0391c76020002aa1dcfc75bae782360bf2761db29f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
x-amz-version-id: bOtNsqPibVajaDyuqqyqCrhSRcjcC6sa
etag: W/"8fa66f8b94450bd040e7b5a7550c52de"
age: 33477
x-cache: Hit from cloudfront
x-amz-cf-id: t8gx0dpBJ5uni5oYtkH1hcqOsK3lJ8vij8HMS6NSZ4ZbWUFbn0Kd6g==
date: Mon, 21 Apr 2025 21:17:41 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 13 May 2024 16:44:02 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 7b2c97c3ba7e37bdd32ec314e5554c74.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL51-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame A6F8 43 KB
11 KB 39ms
36ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 4c0ca2115a672378103dd789c8d593b7fdac79ea2fd10e1f58e589fbe845a41a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=73288
content-encoding: gzip
expires: Wed, 23 Apr 2025 02:57:05 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11318
date: Tue, 22 Apr 2025 06:35:37 GMT
last-modified: Tue, 22 Apr 2025 02:56:42 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 5 KB
1 KB 17ms
15ms Stylesheet
text/css 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-18-160-18-96.iad12.r.cloudfront.net

Software

sffe /

Resource Hash

e53f5143a9fd53deb565ca0f6be2219a940b981bfbc8b5271f1763e4ab631b21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Response headers

content-encoding: gzip
age: 348869
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:41:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:41:08 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 1357
x-xss-protection: 0
server: sffe

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ Frame 15DD 95 KB
34 KB 297ms
25ms Script
text/javascript 64.233.180.95
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f95.1e100.net

Software

sffe /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

content-encoding: gzip
age: 353743
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 04:19:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Apr 2025 04:19:54 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 33951
x-xss-protection: 0
server: sffe

GET
H2 200 ca Show response
choices.truste.com/ Frame 15DD 21 KB
9 KB 556ms
181ms Script
text/javascript 18.160.18.96
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://choices.truste.com/ca?pid=gs01&aid=gs01&cid=21031710&c=gs0243&w=160&h=600&js=pmw0&plc=tr

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.18.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

53e4fe253f55e121f7d63b1fb88db180a4cc82c28219e0d59544015359dbce24

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

content-encoding: gzip
age: 6966
expect-ct: max-age=31536000
x-content-type-options: nosniff
expires: Tue, 22 Apr 2025 05:39:32 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: BCBiUdnCAhF2kLrUTJvGN7p3CwpGerikBD0CwxmUOo8r56BpaZkUug==
date: Tue, 22 Apr 2025 04:39:32 GMT
content-type: text/javascript;charset=utf-8
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
cache-control: max-age=3600
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
referrer-policy: origin
via: 1.1 eb8674b99d3dfcc6867fb20af353442a.cloudfront.net (CloudFront)
permissions-policy: geolocation=(), microphone=(), payment=()
cross-origin-embedder-policy: unsafe-none
x-xss-protection: 1; mode=block
x-amz-cf-pop: IAD12-P4
server: nginx

GET
H3 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.2.4/ Frame 15DD 57 KB
21 KB 293ms
22ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.2.4/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e71-e568"
age: 322425
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7dNSv6RKMR%2BbkfPl3q1pi1s2WZFhvqUKvyHlM6d4cpX%2FxtxMt8epNm4FsOMrihobMJVXaUJYz7Ikz72WIWqMvp8fXGakrOed6I2MK1kYHL691Ox4bek3lyGg9SAYAzbKofX9vwKx"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 12 Apr 2026 06:35:37 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:25 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 93431a299a148c47-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21049
server: cloudflare

GET
H3 200 animation.js Show response
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 3 KB
1 KB 19ms
17ms Script
application/x-javascript 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/animation.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f91e212a6d2a2858397acae51b30df4fe4fde510085fcfad0da26f1333066ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/index.html?ev=01_253

Response headers

content-encoding: gzip
age: 349813
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:25:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:25:24 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: application/x-javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 1276
x-xss-protection: 0
server: sffe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AB2E 43 B
178 B 307ms
38ms Image
image/gif 54.161.245.33
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=2421240&asId=dfa1c9ed-de20-3da1-e73a-aac91d89ad41&tv=%7Bc:ascT7X,pingTime:-3,time:192,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:94%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:193,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:94,wc:1160.1160.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:1160.1160.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B180~0%5D,as:%5B180~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:uJ4MCkp+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e*.2421240-86279845%7C1e1%7C1e2%7C1e3%7C1e41%7C1e5%7C1f%7C1g1%7C1g2%7C1g3%7C1g4%7C1g5%7C1g6%7C1g7%7C1g8%7C1g9%7C1ga%7C1gb%7C1gc%7C1gd%7C1ge%7C1gf%7C1gg%7C1gh%7C1gi%7C1h%7C1i%7C1j%7C1k1%7C1l%7C1m%7C1n%7C1o,idMap:1e*,rmeas:1,rend:0,renddet:DIV,siq:96,nmsd:-1,nph:-1%7D&br=c
Requested by: Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.161.245.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-245-33.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
pragma: no-cache
content-type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AB2E 43 B
177 B 303ms
38ms Image
image/gif 54.161.245.33
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=2421240&asId=dfa1c9ed-de20-3da1-e73a-aac91d89ad41&tv=%7Bc:ascT7Z,pingTime:-6,time:194,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:194,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:94,wc:1160.1160.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:1160.1160.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B181~0%5D,as:%5B181~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:uJ4MCkp+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e*.2421240-86279845%7C1e1%7C1e2%7C1e3%7C1e41%7C1e5%7C1f%7C1g1%7C1g2%7C1g3%7C1g4%7C1g5%7C1g6%7C1g7%7C1g8%7C1g9%7C1ga%7C1gb%7C1gc%7C1gd%7C1ge%7C1gf%7C1gg%7C1gh%7C1gi%7C1h%7C1i%7C1j%7C1k1%7C1l%7C1m%7C1n%7C1o,idMap:1e*,rmeas:1,rend:0,renddet:DIV,siq:96,nmsd:-1,nph:-1%7D&tpiLookup=ao:paint.toys*&br=c
Requested by: Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.161.245.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-245-33.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
pragma: no-cache
content-type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
0 24ms
23ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
0 26ms
25ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AB2E 0
0 24ms
23ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AB2E 43 B
177 B 286ms
88ms Image
image/gif 54.161.245.33
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=2421240&asId=dfa1c9ed-de20-3da1-e73a-aac91d89ad41&tv=%7Bc:ascT96,pingTime:-2,time:263,type:a,im:%7Bsf:1,pom:1,prf:%7BmdA:350,mdZ:747,beA:794,beZ:796,mfA:803,cmA:806,inA:806,inZ:810,prA:811,prZ:882,si:890,poA:891,poZ:924,cmZ:924,mfZ:924,loA:989,loZ:992,ltA:1057,ltZ:1057%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:true%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:94%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:263,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:94,wc:1160.1160.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:1160.1160.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B250~0%5D,as:%5B250~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:uJ4MCkp+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e*.2421240-86279845%7C1e1%7C1e2%7C1e3%7C1e41%7C1e5%7C1f%7C1g1%7C1g2%7C1g3%7C1g4%7C1g5%7C1g6%7C1g7%7C1g8%7C1g9%7C1ga%7C1gb%7C1gc%7C1gd%7C1ge%7C1gf%7C1gg%7C1gh%7C1gi%7C1h%7C1i%7C1j%7C1k1%7C1l%7C1m%7C1n%7C1o,idMap:1e*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:DIV,siq:96,nmsd:-1,nph:-1,sinceFw:166,readyFired:true%7D&br=c
Requested by: Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.161.245.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-245-33.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 43
date: Tue, 22 Apr 2025 06:35:37 GMT
pragma: no-cache
content-type: image/gif

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D725
Redirect Chain

https://ads.yieldmo.com/pbsync?is=ozone&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirectUri=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dyieldmo%26gdpr%3D0%26gdpr_consent%3D%26us_p...
https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcS4877dS47Eocum116Q&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone

0
753 B

40ms
39ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcS4877dS47Eocum116Q&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93431a29ca5cc33f-EWR
expires: 0
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

location: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=xcS4877dS47Eocum116Q&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4161161628424474210

86 B
969 B

26ms
26ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4161161628424474210
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745303737&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=0CGcd9JaX%2BfPZelPhYt8A%2FJzDykpGgpeb4XnTOHYST0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 22 Apr 2025 06:35:37 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745303737&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=0CGcd9JaX%2BfPZelPhYt8A%2FJzDykpGgpeb4XnTOHYST0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93431a29deee437e-EWR
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4161161628424474210
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 151.243.141.142; 151.243.141.142; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d723e5d0-3b80-400d-9bf0-3e2ab0cd42b6
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 22 Apr 2025 06:35:37 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame AD1F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

269 B
379 B

36ms
34ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Tue, 22 Apr 2025 06:35:38 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 22 Apr 2025 06:35:38 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
server: AkamaiGHost

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D725
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=u40cpuw&ttd_tpi=1&gdpr=0&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0

0
965 B

39ms
35ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=8b7af7ac-6ac9-40ee-ba0f-84bc930a3544&33across.com=null.0014000001YrMoYAAV.1041.cgyW7tB3+JhufhfPmu/bYSykFVJRLq+8qcpAUJ2uWwy99T12VxqpfrL2hkQr5VG+lkJi+dhT+iCAGcS96st3zRo6+viKXIZ/g+ze3bF2BN3fyN4UDc12qe7WFwbB03zZxAX2wNh8I7g3Uq9M2yn4wVJfq7ApC0g45K/jhGMSCE26EnwDia+aBq+LJgymRgrEL1P7n6mZ9FVlYOBN1k/FxIxQXBE5J8L/ZugJNpnwtzpKtV/JQJj6sqVVFKPMDo8JhoDezzCQn671b84lCcBg1jiRPfjoR7SjfvweW64qGg1sgRt3D9ymqhYp6wLN78EL9YLePykGpCjIEXXtm38/Vy/QHNycyV7SVOhwR3JzWtdOki4pcqJ88t6G2D+vRW3ZfkEib5sJrQD64c9qvbqT21YenrdusYsre0TcyJ0DeKdHsUanAqYW6G5rEBsBBJ53z4AU5f4OUm1jaULDWg7Wd49J6m0QmLA4yjkbzmatPNMdVgBr23vBw0PWVgUUdf+XAjMoWvG0biM8QmuqIfq1adi/oqHEsnlHuUWMgWBM0H0EsNysm/yjMCY+M8R0f8cC5VHOUk9G7P/upqN7pWg5+kq63Dv2QPbkCYs7gTWqR6s6F49oTO2wjrtNNxmtTLhSZgg+rBsbcYYbD9f+BCT1UAhHBmQmb220vNEYTHaoki+MnowJRQ8PrCm1QXx4WpNcYYLQ9JW7TaRaX/j7YtK84Be6bd9lZaw9uZpS5fzRTDBRo08D4Y3pR7dlnNA9VFK54VHsXYiXSH+6frIh7G9G6bd5v2Cib89khCjUqe8uSl4HOf8RW00Cwx3SY+PoyUwQEP0jgaFOVol0IhZt6A/ZAeU4SDmdJmkD3mOHKKWM6wlJrdx/SWYETH+KjcmFYQY7oM4M1ZHczWJxTh7OnP6TZVUl3PKI492cq4RVYtMye8dvPE4zCQe1zQHpPEiH6cm92AxPKdwWBLLCqzXRQDn2gzh0OZhwQfHNx2v4M4fEOv3btGOtwTSVqN2zEIgRhNzeNxsbwxHvF6hnOfDTeg1eBwCOdZFhTbcIfB2iMEhWJG3heyGttuyiVa01oarEVmA7mezhO61f2w5yWYGNXqwBfT9CQ/S2ynMrHKVfvw6Q8NpBStXKPizXaRUiHx9XkvrMjdZEK6zEDi/jPDEys6LTbuIDusSbdwNqZprQfjXT33yuI+qTQ9qtfWRWcjQtj4pard8Gt1yI3uAM9ypWAH43GPXRbpX6yEWM0DWDGETejxpt/LP9QmkSglGeW7DA7U4Lt4VWr+fjrWzPJTtyuHLegmSzNDvU/FQAoUQahrbg0yPSY6KnZ9J5x2WNv24UMe5KqHTkAkeWY7rnQSmR30MtLPuy21c/efMjSZ8IICgM8hAGlvoHqQA28nFYTWuGbyx2W/hrri3rn6rEowvPJXPZ2JiLZa9T3nKYmNzml6/TXyQOScksbMEuMtXQc5R3dXAA4kF7uekBVZoe8D19+hIIDzMdkUjhbgoneHbaHB65NWGcP1CtWFW4JHz9gwJbsIOD&linkedin.com=fcadc0a8-9f11-4f3d-8679-8be367b61a52&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745303735609&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93431a2a6a8dc33f-EWR
expires: 0
content-length: 0
date: Tue, 22 Apr 2025 06:35:38 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

location: https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=d6fb373e-9e5b-4daf-bcc5-b2e8b226f8e0
content-length: 215
date: Tue, 22 Apr 2025 06:35:37 GMT
server: Kestrel

GET
H3 200 bg2_1.png
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 35 KB
35 KB 17ms
16ms Image
image/png 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/bg2_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3de4cabaa2910ed98f7526bbafaa9870fb9b73ca9794ce599bb6ea4ca49a183a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

age: 350729
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:10:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:10:08 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 35584
x-xss-protection: 0
server: sffe

GET
H3 200 txt1-a.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 2 KB
898 B 23ms
21ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt1-a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bb367447a8a03e8d4e4f3c77e4b7e59f6d2f3bf54780aad8cde51a0c9e03528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 349375
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:32:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:32:42 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 868
x-xss-protection: 0
server: sffe

GET
H3 200 txt2-a.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 2 KB
886 B 25ms
21ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt2-a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca26296485afb93f7a5c35f03837b0459f1b45a3854724a23f0972b423665b09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 351134
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:03:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:03:23 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 856
x-xss-protection: 0
server: sffe

GET
H3 200 txt3-a.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 6 KB
3 KB 25ms
22ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt3-a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc48313e77e0a61ff699fafc647a0bbc7c5866e349f30481f1ac52fab5aa6b63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 350729
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:10:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:10:08 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 2585
x-xss-protection: 0
server: sffe

GET
H3 200 txt1-b.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 3 KB
1 KB 25ms
22ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt1-b.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66105dc69ff97b5a6ab89d17c79bbd4b391c5872473142b91259314deb19209e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 348444
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:48:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:48:13 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 1239
x-xss-protection: 0
server: sffe

GET
H3 200 txt2-b.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 2 KB
1 KB 32ms
29ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt2-b.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36ee1cafe491102645528728792cf5f0160fc4f6071cab3c6b9044f55c91c1f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 351134
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:03:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:03:23 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 1069
x-xss-protection: 0
server: sffe

GET
H3 200 txt3-b.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 6 KB
3 KB 50ms
47ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt3-b.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d94a9cca8547a60146e9ee124e97c3836989b49bc69b824a416e867056282a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 350980
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:05:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:05:57 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 2584
x-xss-protection: 0
server: sffe

GET
H3 200 txt1-c.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 3 KB
1012 B 49ms
46ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt1-c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24a0f4f0117fae7599e8afc8036d4174beb54215af320320c2f44f16cf77e33a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 351134
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:03:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:03:23 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 982
x-xss-protection: 0
server: sffe

GET
H3 200 txt3-c.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 6 KB
3 KB 27ms
24ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt3-c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee0449afd73cb8b13033b6271ca7492a77100383c2fc1054b19dd1243ee1048f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 350729
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:10:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:10:08 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 2585
x-xss-protection: 0
server: sffe

GET
H3 200 txt1-d.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 2 KB
1 KB 29ms
26ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt1-d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfff35bdaf6336f6eef28d49c4e006a73f4a8874ca8aa0c879787fef42cc9b16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 351370
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 04:59:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 04:59:27 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 1078
x-xss-protection: 0
server: sffe

GET
H3 200 txt3-d.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 7 KB
2 KB 28ms
25ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt3-d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b237102172f83e3ed52b0a744ee617707ab4b9e755954effe9b55bdc3be452b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 349375
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:32:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:32:42 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 2419
x-xss-protection: 0
server: sffe

GET
H3 200 txt3-e.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 8 KB
3 KB 29ms
27ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/txt3-e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

070035107e7109f36b8317fa58771de357e9473e1e131bc8489ec10c2b58a948

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 349375
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:32:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:32:42 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 3070
x-xss-protection: 0
server: sffe

GET
H3 200 apy.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 1 KB
728 B 29ms
26ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/apy.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc59c4c01e0fd7465963924e779a8576b517b5adeeafa43ddef9f1f8901459cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 348444
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:48:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:48:13 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 698
x-xss-protection: 0
server: sffe

GET
H3 200 cta.svg
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 3 KB
1 KB 26ms
24ms Image
image/svg+xml 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/cta.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0a64bee9cc136b8cc007b45307dee6f80fe2e178276853cac44c741ef5be73c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

content-encoding: gzip
age: 350729
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 05:10:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 05:10:08 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 1270
x-xss-protection: 0
server: sffe

GET
H3 200 BasisGrotesquePro-Regular.subset.woff
s0.2mdn.net/sadbundle/1231298801604493312/ Frame 15DD 3 KB
3 KB 20ms
20ms Font
font/woff 172.253.115.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1231298801604493312/BasisGrotesquePro-Regular.subset.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41c4c60e2f62af27e8a93591d0e09304770f7a0b3106720d64000afdf553ac03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/sadbundle/1231298801604493312/styles.css

Response headers

age: 351370
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 18 Apr 2026 04:59:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 18 Apr 2025 04:59:27 GMT
last-modified: Tue, 04 Feb 2025 19:35:20 GMT
content-type: font/woff
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 2872
x-xss-protection: 0
server: sffe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9AEC 0
20 B 41ms
41ms Image
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BpKXkuDgHaKWWNouToPMP8vOZ6Q0AAAAAOAHgBAI&bg=!Q0ClQA_NAAZDHFaHYxw7ADQBe5WfOKKkHy2Hswg80O-Gc7vES0-DSo9ykyxvpT4AZ2GjAJBznHteTD303mqYXgrzdtqEAgAAAmxSAAAAB2gBB34ANVPWI06H6BL0i3aeJ-FxlAPdsFafyuxC9UxlnzsDj4uv7-jTHNaKXCIrllgz4Qi4lz9Y8mj5mQKi3sS3_D0etjLi9GNgd7JdIld5UG2vcSieuJtZ7E3zhkhdUzV_eYyfKK5Dfkqxr2hi5Jds15zJwcCNbwtC0ygOZOjGIhqwz9vOFUn5iu-sXLiPk2pXKRb8QgZfsaIbwcRuDcujMr5nldH7HvcbY6VHY8GWafQlDbO9zgK0edHfvjjaQHJqhHQOCTxS1MNnF_zTlrYjKtidVX_aFXxBgfJ4BUTQjZxO5-bXGXY3q4zBr3zfo-gWXZnA0f_WK0trFnXrtAHyDKEudC4p_L0VOGiExVA6zTZmfjbL0RfIhFxbpk3H26j3BoRh418z5HW67mWaN65fHAcswZ9Uq7LqRWuCj8VzA2MVBHRn0bZR9HweFlLcLYL3bSJx2r1SVOuWHXAHjqED-V8nXztbGe0A8wp5J0zNrxeZHy-P3qstc2ULMDmSCU1lDIl2N_LquuMEg2wJchS8LSodLlg9YZS0Fd6eS6WgvYd3ifGKddB7h_nJpVIXiLO--1FLHyNLHd1p5hAg0sxEJSfDrDfnKJJy5qC-uXrban9v3PFj9HkQf3RokouZIlksBL20260Z5XoZReYAqH2X7TtM_u40WeBW9KwMrxz2Dr1225Wz8UT_Kta5X61O_Mq96XIK8qCfLJ-OZtZnlby-ZPgUB67O0hrenASg057bB7TLyOP7gFDWpDRgq7VyrUn6zyjGSg84hRIkKaLz9Dq3bBO6nuCEthAVPlXzKlO0OfndI-3pbxNp-BbwvDGoZUS2MSb2lWkhwthh4fldm90X6PSeOalvTP9_9fgTiJN1wj__7Zmj3EAmauGghKZgzBzfO9no4TC8hL9FDKMZkCWrO0K0bk5Jk2qaQJ-uRnPLcnlUlKFINnRMY6UjFgLYQ6WGXd2Ve139mLj-91hSbRo

Requested by

Host: 4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com
URL: https://4c057d7f06a55c3341f09e7114aeab19.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS