paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.themccuskers.com/cnhcpbojwukkfefykyROVdWZ3F1VDl6SWxWWDZnZUQxZWotMjY4Ny0yNjcyMDg3OS0xMDMyMDI4MS0zODMxLWhhR3RYUXBkZDVndmRoWVpBZ1V4/nara6c7b27adouf5v48o6nf03iaxarviovoy9ensx8ro/8nj4vdsmym02uv11vygwo9myg/yxyvdhjlxmdnx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 453636
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1632
content-type: text/html; charset=UTF-8
date: Thu, 24 Apr 2025 07:48:58 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JSKCAWH4F5NPSPNKJ4T4Y3AG

Redirect headers

accept-ranges: bytes
age: 453635
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1632
content-type: text/html; charset=UTF-8
date: Thu, 24 Apr 2025 07:48:57 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JSKCAWF5RG5F98B2527YCPYK

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 195ms
84ms Script
application/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: daa1e3c07831e96fc363c62a978cd8de1a1e84659329d23ed5d181602da2b96a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-ray: 93540057becdab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 22ms
20ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 38168
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JSKCAWJZBQG27Y4Y8XNZPH9M
cache-status: "Netlify Edge"; hit
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 68ms
66ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 89593
accept-ranges: bytes
content-length: 1161
x-nf-request-id: 01JSKCAWK2H29E4NQ413X0T4GE
cache-status: "Netlify Edge"; hit
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 27ms
25ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 221020
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JSKCAWK22QD86289M5KGK089
cache-status: "Netlify Edge"; hit
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 50ms
48ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 38168
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JSKCAWK2TQCW4T2J5FATK3Q3
cache-status: "Netlify Edge"; hit
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 23ms
21ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 38168
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JSKCAWMM180JJ2W5ABANC4H6
cache-status: "Netlify Edge"; hit
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 28ms
21ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 4955
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JSKCAWNARNCMB1KNJ2C95QD4
cache-status: "Netlify Edge"; hit
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 93ms
53ms Script
application/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7a5db38dd0c0de0c2a88b7f0b556be54ba249cf60d7dc0e2916401f041d12cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 93540057bed0ab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 366 KB
123 KB 238ms
108ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

813d19122218a749ee23376189267d66830c66386ea08681b1709a8f7c176182

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1063:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1063:0"}],}
expires: Thu, 24 Apr 2025 07:48:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1063:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1063:0
content-length: 125181
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 6cda37ed9d64730fff14a98136392a11488392821de688ff.v1.js Show response
faucetfoot.com/ 68 KB
25 KB 209ms
69ms Script
text/javascript 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/6cda37ed9d64730fff14a98136392a11488392821de688ff.v1.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

c529ce74aa445d56f3203d1e47c3483787a3d00cadee693b4ca4626e0cafa476

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"1bf2bc66f7278e2e45e12fabc5bbb3a6b47da9891e0e2f46f72bd19986ad4f8d"
via: fen-hoothoot-us-central1-test-d239.gce-us-central1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 138ms
77ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f44022f70f3bde1723ddaa229484abc3932f0b911b844ec996f0ebf9a154f24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 138 / 20202 / 31091935 / config-hash: 14243977761787557131
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 07:48:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33842
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 49ms
47ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 3862
cf-ray: 935400586f58ab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 411 B
336 B 100ms
99ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b35367386570f17ff5be2b4d3f5a9ef2816b7947869005cfae73ec88dcba460

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"038af8099c70ce8099f11e60671651ea"
age: 3285
cf-ray: 935400589f7dab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.f78d8905f1617efa83f4.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
2 KB 36ms
33ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aed279b0a29e774ca22dafc6a078e7582490608c9d18bda1a138ca55d0d5be9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"f1a6e4325cdcf59d711cbdc9bbf9de8f"
age: 4591
cf-ray: 935400593feaab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.f49d9d120d738f961843.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 461 KB
140 KB 63ms
61ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad7d0d55c693f50a025e443da2f37eaea32dad37cbfe918cde1717f8f33af733

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"2da544a46407e9f6f4d2fc5d5058f814"
age: 605
cf-ray: 935400595ffeab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/ 529 KB
167 KB 51ms
50ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

cdn-185-199-108-133.github.com

Software

cafe /

Resource Hash

46dbde2e85fb6e7742a84aed597b96efcd3013b2d8e062036d17042cb0d5b4dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8730332818216492985
age: 60449
x-content-type-options: nosniff
expires: Thu, 23 Apr 2026 15:01:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 23 Apr 2025 15:01:29 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170651
x-xss-protection: 0
server: cafe

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 559 B
444 B 34ms
33ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 3763
cf-ray: 9354005ad919ab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 4525 503 B
428 B 149ms
51ms Document
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 5317
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9354005b9b26abe8-YYZ
content-encoding: br
content-type: text/html
date: Thu, 24 Apr 2025 07:48:58 GMT
hw-country-code: CA
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 51FC 503 B
0 145ms
145ms Document
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e6b2bccb3f889bf35badc933d9beecd2219914e6ba548166b196a64574ab78

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 5317
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9354005b9b26abe8-YYZ
content-encoding: br
content-type: text/html
date: Thu, 24 Apr 2025 07:48:58 GMT
hw-country-code: CA
last-modified: Wed, 16 Apr 2025 13:33:15 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 TIER_1 Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/3/desktop/Chrome/ 584 B
921 B 203ms
82ms XHR
application/json 108.138.128.54
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/3/desktop/Chrome/TIER_1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-54.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 13101ef533b5621119cbf5faeadf81886da50a9521d32da93657ee0ad7c71a1a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 2175
via: 1.1 e5f49cd65618fc548cd417b060a75e76.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 584
x-amz-cf-id: QukW2XT8mjtOCOTDWdRctI-bJ2plpbjLt5RMv1HGKvx5fjRVhHCY6Q==
date: Thu, 24 Apr 2025 07:12:43 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 150 KB
39 KB 118ms
42ms Script
application/javascript 104.22.74.216
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.74.216 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0547de2d74863fb82ea56aca5316c396630ed9bdb0ce25160701ddfcdf681dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "b76ae92b9a51835b2b516c978d2e492c"
via: 1.1 google
cf-ray: 9354005b987836b5-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39875
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: application/javascript
last-modified: Thu, 24 Apr 2025 07:20:54 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 358 KB
87 KB 119ms
37ms Script
application/javascript 3.171.136.233
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.136.233 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-136-233.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3e7cec086c6f1c8c57de8561ce5bb8488e68b27391b0d6e8fb0ee471b9de187f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"4173e93caf83178c49bea9e2ca115e00"
age: 1124
via: 1.1 5afe13d9a6dd513ea0054947fa28dc18.cloudfront.net (CloudFront), 1.1 168a3079f6c62f465885c1d82b0b1d5c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: DJ0JYAy1jnoq-3z3Ae7bdFgwFegFpuF7q10gJXiLamXXmWNyALk0jQ==
date: Thu, 24 Apr 2025 07:30:15 GMT
content-type: application/javascript
last-modified: Mon, 21 Apr 2025 17:15:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, JFK52-P8
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
587 B 110ms
45ms Image
image/gif 185.199.108.133
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.108.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 766de544ee5b2885c7bf015ef085633e4fdac047
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: CE4F:7E6A2:19228A:217343:67E8E710
expires: Thu, 24 Apr 2025 07:53:58 GMT
x-cache: HIT
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: image/gif
x-served-by: cache-yul1970034-YUL
x-cache-hits: 1
source-age: 131
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1745480939.803894,VS0,VE1
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 132ms
48ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 2171
via: 1.1 534f7e815b25f5cd40ef32ea39fc9a8c.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: DbqLncrRJVMWB8DNP8a_o-NvemYeXWXSoMRlL1KLBf87o6LPnK9TmA==
date: Thu, 24 Apr 2025 07:12:58 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 165ms
86ms Image
image/gif 18.173.132.14
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=xsrmnm_728x90_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-14.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 77144
x-cache: Hit from cloudfront
x-amz-cf-id: P8C2AKUqabN3VwMXnQS-4PFHfRo6DZQG1Z3m9KFsIgApcGD06o8OCQ==
date: Wed, 23 Apr 2025 10:23:14 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 19f6dea8d52f4770f090ce0929599570.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
109 KB 81ms
77ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54m0v9101576445za200&tag_exp=102803279~102887800~103027016~103051953~103055465~103077950~103106314~103106316~103130357~103130359

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c94ebfcf0fe75037334c7c39229294df9ba5603c3b7935fbfae71ac2c2ebf08a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1063:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1063:0"}],}
expires: Thu, 24 Apr 2025 07:48:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1063:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1063:0
content-length: 111145
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 215ms
115ms Fetch
text/plain 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54m0v9101576445za200&_p=1745480938068&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102887800~103027016~103051953~103055465~103077950~103106314~103106316~103130357~103130359&cid=917327631.1745480939&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745480938&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.themccuskers.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1683
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s73-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 200 KB
65 KB 229ms
117ms Script
application/javascript 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5cafeaa2af44e11e783245867c293044f3251f49d0c04ac1697db28a0f78a1cb

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_ribJoLzvMda0zfoHreEVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw0JBiOHHrNtMFIG69eY51KhAbrT3P6gTEhgqXWB2B-P66S6zPgfhD_WXWH0BcJHGFtQmIP1XdYBWqvsEam3aTNRWIe_feZL1x5Cbrro23WA8BcbP2bdZuIBbi5nh9c_kBNoEfd495Kmkk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkamBgZ6hkYxBcYAAB4xUTD"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_ribJoLzvMda0zfoHreEVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 4525 17 KB
7 KB 42ms
41ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 5232
cf-ray: 9354005c9bcaabe8-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250415.1/iframe/ Frame 51FC 17 KB
0 37ms
37ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250415.1/iframe/iframe.html

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 5232
cf-ray: 9354005c9bcaabe8-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:58 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:16 GMT
vary: Accept-Encoding
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
549 B 128ms
41ms Image
image/gif 104.22.5.65
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 260012
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvvj4uuyFyKJoBxk7zfwHor5WkY3TXsupUdVp7mBv-JiVUcI0lAbPnPeOIzHHY-bTER1SWvPDo
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9354005d484bebc0-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 85ms
35ms Image
image/x-icon 142.251.40.198
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f10.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 27697
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 25 Apr 2025 00:07:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 00:07:22 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 128ms
42ms Image
image/gif 104.22.5.65
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9240400400967534
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 260012
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvvj4uuyFyKJoBxk7zfwHor5WkY3TXsupUdVp7mBv-JiVUcI0lAbPnPeOIzHHY-bTER1SWvPDo
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9354005d484cebc0-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 131ms
56ms XHR
application/javascript 3.171.136.233
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.136.233 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-136-233.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 206
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: 6004HHlIfy_bdTpGZfsxFUp_ILuZs1M7r7rweRmfTG6L5ATuy4s-JQ==
date: Thu, 24 Apr 2025 07:45:34 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 645b3b9307ff6780fc1a76b712bc5728.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 161ms
84ms Script
application/javascript 18.173.132.67
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-67.jfk52.r.cloudfront.net
Software: CloudFront /
Resource Hash: 49abaa85c5deba189aed627d20598003159c74478ec1ef492cfff2bf98c5eec9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1420
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: bYAhA7MxumIR-4zHY24I5CiqYCdLZMAqP1i6xH9pxEPF-f1o03eyvg==
date: Thu, 24 Apr 2025 07:25:19 GMT
content-type: application/javascript
x-amz-cf-pop: JFK52-P2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 29ms
28ms XHR
application/json 3.171.136.233
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.136.233 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-136-233.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 3831
access-control-allow-credentials: true
via: 1.1 168a3079f6c62f465885c1d82b0b1d5c.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: QhuNxGZakkOBWOCkroyoa6uB-NGNZP0heaqyRIafxw14Is2zo90SiA==
date: Thu, 24 Apr 2025 06:45:07 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK52-P8
server: Server

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 60ms
58ms Fetch
text/plain 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54m0v9102396898za200zb9101576445&_p=1745480938068&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102803279~102887800~103027016~103051953~103055465~103077950~103106314~103106316&ptag_exp=102803279~102887800~103027016~103051953~103055465~103077950~103106314~103106316~103130357~103130359&cid=917327631.1745480939&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745480939&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.themccuskers.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1745480938067&tfd=1919
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54m0v9101576445za200&tag_exp=102803279~102887800~103027016~103051953~103055465~103077950~103106314~103106316~103130357~103130359
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s73-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 561ms
45ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qwxz.themccuskers.com
URL: https://qwxz.themccuskers.com/cnhcpbojwukkfefykyROVdWZ3F1VDl6SWxWWDZnZUQxZWotMjY4Ny0yNjcyMDg3OS0xMDMyMDI4MS0zODMxLWhhR3RYUXBkZDVndmRoWVpBZ1V4/nara6c7b27adouf5v48o6nf03iaxarviovoy9ensx8ro/8nj4vdsmym02uv11vygwo9myg/yxyvdhjlxmdnx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 24 Apr 2025 08:03:59 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 24 Apr 2025 07:48:59 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 48ms
44ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qwxz.themccuskers.com
URL: https://qwxz.themccuskers.com/cnhcpbojwukkfefykyROVdWZ3F1VDl6SWxWWDZnZUQxZWotMjY4Ny0yNjcyMDg3OS0xMDMyMDI4MS0zODMxLWhhR3RYUXBkZDVndmRoWVpBZ1V4/nara6c7b27adouf5v48o6nf03iaxarviovoy9ensx8ro/8nj4vdsmym02uv11vygwo9myg/yxyvdhjlxmdnx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 6933
via: 1.1 534f7e815b25f5cd40ef32ea39fc9a8c.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: uOPFbDE_m7u4r3wjuB6JKbT73E7dNm1in0cmLJCS5bWkaTWGbtpB8g==
date: Thu, 24 Apr 2025 05:53:27 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
342 B 567ms
52ms Script
application/javascript 104.22.52.173
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.themccuskers.com%2F&_it=amazon&partner_id=403
Requested by: Host: qwxz.themccuskers.com
URL: https://qwxz.themccuskers.com/cnhcpbojwukkfefykyROVdWZ3F1VDl6SWxWWDZnZUQxZWotMjY4Ny0yNjcyMDg3OS0xMDMyMDI4MS0zODMxLWhhR3RYUXBkZDVndmRoWVpBZ1V4/nara6c7b27adouf5v48o6nf03iaxarviovoy9ensx8ro/8nj4vdsmym02uv11vygwo9myg/yxyvdhjlxmdnx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.52.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=432000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"ba4f7a703ea78ac1b72b5fe1be4fb407"
age: 1861
cf-ray: 93540060dee6ec71-YYZ
x-amz-request-id: 30ESW1W2ZK679RV0
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/javascript
last-modified: Thu, 05 Dec 2024 20:48:49 GMT
server: cloudflare
x-amz-id-2: vUR56U4dT+uBLcfsQJPOy5zt8YY70QBqRK79jcTJYD4WF5y07NSxKqBZ9MkC3NxK2u5wo1slGAE=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 563ms
49ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

007036d465b81110214bfc2593974dfd94e31304794dd2e2f0a85adf880cf472

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: +WFF8OCkW+HpLxb6XzNqsD43ZBHX0wv82UchrjntYz2o7rYF2MtR6mPMFf77Nwt3XhkZiLLnyosjqDL6SqAwLg==
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"e080505431750bcc4447c43d487f9da4"
age: 3465
x-amz-request-id: 90YPYX9PRQ5YQZ84
cf-ray: 93540060dd3436c7-YYZ
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 18 Apr 2025 14:04:56 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 558ms
45ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qwxz.themccuskers.com
URL: https://qwxz.themccuskers.com/cnhcpbojwukkfefykyROVdWZ3F1VDl6SWxWWDZnZUQxZWotMjY4Ny0yNjcyMDg3OS0xMDMyMDI4MS0zODMxLWhhR3RYUXBkZDVndmRoWVpBZ1V4/nara6c7b27adouf5v48o6nf03iaxarviovoy9ensx8ro/8nj4vdsmym02uv11vygwo9myg/yxyvdhjlxmdnx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 24 Apr 2025 08:03:59 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 24 Apr 2025 07:48:59 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET 5821b807-f91d-4a9f-b86b-cd464c40d6b0
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 242ms
33ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 24 Apr 2025 07:48:59 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 185810
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 556ms
44ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 34545
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745438093&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=IFJxCgNiDCGNWSy3KpFFCAH8T7Wn393k5oow0Qb6hWM%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Wed, 23 Apr 2025 19:54:53 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745438093&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=IFJxCgNiDCGNWSy3KpFFCAH8T7Wn393k5oow0Qb6hWM%3D
hw-country-code: CA
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 93540060c80cac54-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250415.1/ 3 KB
1 KB 56ms
55ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250415.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/runtime.f78d8905f1617efa83f4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 3763
cf-ray: 93540060cd25ab1c-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 13:33:08 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 303ms
46ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.themccuskers.com
URL: https://qwxz.themccuskers.com/cnhcpbojwukkfefykyROVdWZ3F1VDl6SWxWWDZnZUQxZWotMjY4Ny0yNjcyMDg3OS0xMDMyMDI4MS0zODMxLWhhR3RYUXBkZDVndmRoWVpBZ1V4/nara6c7b27adouf5v48o6nf03iaxarviovoy9ensx8ro/8nj4vdsmym02uv11vygwo9myg/yxyvdhjlxmdnx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: ec84565aff4ab5ec7fb62823659a3cbaad505c4c4d70d591b42347bc88604570

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 446 KB
141 KB 370ms
117ms Script
text/javascript 142.250.81.234
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.234 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7370b11c9e876fce5bbbd74146813bff5cd17118e39466089767c746e8660d74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 14398181731056728489
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 07:48:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144285
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 550ms
273ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-84-72-103.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
855 B 298ms
80ms Fetch
application/json 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: b4c2c6142c12d3fbf4b07f461eab8a2088612ad251ca9f6493a599172e43abaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
685 B 266ms
46ms Fetch
application/javascript 34.196.240.40
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.240.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-240-40.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 549bf7f7f794a5fc8091d74f5aea1af6ad6e0b2a06c85bb7c77e411a8c22a6b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 287ms
68ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 04e7ec0e86f1f4c820726d6379414296b00c1a0b9b5036602e8730067a6f9de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 519 B
932 B 284ms
67ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jskcay45cjtg4kreqh8qw10v&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ad776e799bf28e5e2411adc67a4e6f21495a3b440fc62374cff879fb5e012473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 1b8d569e7061f1cb
request-time: 5
access-control-allow-credentials: true
expires: Fri, 25 Apr 2025 07:48:59 GMT
access-control-allow-origin: https://paint.toys
content-length: 519
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 362 B
959 B 96ms
37ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

79de219cffd3b4758e4da88bcd2167c82115d2d345fc68788627f4b7a698be69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 464711
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 826 B
698 B 386ms
228ms Fetch
application/json 108.138.126.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.themccuskers.com%2F&pid=dYx7Aqpvd9PQX&cb=0&ws=1600x1200&v=25.414.1933&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=661250a1-9672-4124-a3ff-213c03ebf052&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.126.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-126-61.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: f875a06256487dad6b3d3be2a1eaca0a1dc3c7fd6ec2d35bdc2032344e1e02b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 dd80355363eac92e0372107558e579a8.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 366
x-amz-cf-id: 1eRgCYwJ6ERviBW0vu-V3toxFmNF2RIDxU9hP7ycJjCmAvEwl2Jl2g==
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P4
server: Server

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_e5c7871d-e20d-4f28-a0bb-70e54cd789b7_1745480939118
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_e5c7871d-e20d-4f28-a0bb-70e54cd789b7_1745480939118

1 KB
2 KB

38ms
37ms

Script
application/javascript

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_e5c7871d-e20d-4f28-a0bb-70e54cd789b7_1745480939118
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: 6292c4237218ba782d8eac5a125aa2f585d01d75cdf6c7496ec69e16a20ed55e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 24 Apr 2025 07:49:00 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_e5c7871d-e20d-4f28-a0bb-70e54cd789b7_1745480939118
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 24 Apr 2025 07:48:59 GMT

GET
H2 200 AGSKWxUAzGHqaQtlOdR3DwRt3UMngA4X30SIcsd7osKxuUCp77pEzpJkHtYJOvL-d39SuhTZmBJGVo9CEBdoQe4ihQid2Im2EM-F2IeJEM2ry-8ZRUcGpLcw-6-uasW9-bLB41sMeUUBJA== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 77ms
73ms Script
application/javascript 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUAzGHqaQtlOdR3DwRt3UMngA4X30SIcsd7osKxuUCp77pEzpJkHtYJOvL-d39SuhTZmBJGVo9CEBdoQe4ihQid2Im2EM-F2IeJEM2ry-8ZRUcGpLcw-6-uasW9-bLB41sMeUUBJA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NDgwOTM5LDgwNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ5bjE2N1V5NnhHSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LnRoZW1jY3Vza2Vycy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.yn167Uy6xGI.es5.O/d=1/rs=AJlcJMxB4EEYpDjr-iyjaCleSImEglcNUQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7df138cc813b6d11ea0a5a288454b24e76adbf19971cadb4db0e81124517322f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-uu4M0gdqo4xw5SFUagWykw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxs_Zt1m4gFuLheH1z-QE2gQ3nTsxiVtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDEy1DMwiC8wAACuNj-e"
content-security-policy: script-src 'report-sample' 'nonce-uu4M0gdqo4xw5SFUagWykw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame B4F0 101 KB
28 KB 110ms
51ms Document
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-108-138-128-120.jfk50.r.cloudfront.net

Software

sffe /

Resource Hash

190f676ee781e35d2d2a8c07e56b2ca05fe36625bbc7a5cfec2f3a060a45c3e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2919
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28980
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Apr 2025 07:00:20 GMT
expires: Thu, 24 Apr 2025 07:50:20 GMT
last-modified: Mon, 21 Apr 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 159ms
55ms Script
application/javascript 108.138.128.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.128.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 2731
x-cache: Hit from cloudfront
x-amz-cf-id: oJ839e2k9cAP0pIPqWXWWXbLeDO1FN5DaZ5lm_NQ_YOYH7HdGs-Org==
date: Thu, 24 Apr 2025 07:03:29 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 5d3699e517195152b2b0917312ab80b8.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 114ms
33ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 126836
x-goog-stored-content-encoding: gzip
expires: Wed, 22 Apr 2026 20:35:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 22 Apr 2025 20:35:03 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwrVmZDS9cznHqkf2h0wXmwPzQ6q96mL7NjwR7JdKFeTZ1auuIaoZ58wgNTXlPnU6PbKRi5V4xw
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 526ms
436ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: ed90a8c0c4ee9ee9ec31dfc23a29e705

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 119ms
41ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 429902
cf-ray: 935400627c0c3a02-YYZ
expires: Sun, 27 Apr 2025 07:48:59 GMT
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 136ms
66ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 25 Apr 2025 07:48:59 GMT
access-control-allow-origin: *
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 35ms
34ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 24 Apr 2025 08:03:59 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 24 Apr 2025 07:48:59 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 192ms
157ms XHR
application/json 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: a96dc4607cca45e9b6e6fa9a1ba530e4067769121aa73193f2b84aa7a95f595e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json;charset=utf-8

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
565 B 128ms
96ms XHR
application/json 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: c69999d655081bf3b2872089a51d486a3bc86f1b18239286b74e90794d0fef3f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json;charset=utf-8

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 6388 2 KB
1 KB 324ms
85ms Document
text/html 23.45.193.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.193.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-193-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=115162
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: Fri, 25 Apr 2025 15:48:22 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 153B 1 KB
2 KB 115ms
27ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2876
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 24 Apr 2025 07:01:03 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwqtycsZZv9kZ-nRhVCG2R7mSsMDF7Ud_E3pDGzotmbMdvwIdhUzdVRKkWuJ8klCE5Q

POST
H2 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 234ms
82ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ff9b7ad5b9faf1d60dc3420df942d79908b21c56e351009b6cfb6554872898c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json; charset=utf-8
vary: Origin
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 935400636c292706-YYZ
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H2 200 auction Show response
prebid.intergient.com/openrtb2/ 425 B
402 B 580ms
433ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86d3d2a2864ac7fe8f9818e6baff2a174c90ede9bb676ac4c30db51d85f7cd64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Origin
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 935400636c282706-YYZ
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 198ms
39ms Fetch
application/json 34.206.110.156
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745480939896&to=420&aun=pw-160x600_atf&pubcid=51e0bc8d-5434-429d-9324-8bef60b2a3e4&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=2f99df25-d63c-4e7a-98ad-09cefa4cc862&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.110.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-110-156.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 196ms
37ms Fetch
application/json 34.206.110.156
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745480939898&to=420&aun=pw-160x600_btf&pubcid=51e0bc8d-5434-429d-9324-8bef60b2a3e4&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=9e31f406-86f9-4ce2-9bd4-40ba60c2c5fa&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.110.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-110-156.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 196ms
38ms Fetch
application/json 34.206.110.156
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745480939898&to=420&aun=leaderboard_atf&pubcid=51e0bc8d-5434-429d-9324-8bef60b2a3e4&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=58d0c2a3-8c56-4bf5-9ad6-605968b5a44d&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.110.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-110-156.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 196ms
38ms Fetch
application/json 34.206.110.156
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745480939899&to=420&aun=leaderboard_btf&pubcid=51e0bc8d-5434-429d-9324-8bef60b2a3e4&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=517de07f-024b-491a-a20d-82521b90626e&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.110.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-110-156.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 638 B
758 B 280ms
119ms Fetch
application/json 3.85.189.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.85.189.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

f2fe532c293fb66f8d82ca42c43d0aede617f7237e4a34c88e49f7d90145c7ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 402
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 684 B
770 B 296ms
135ms Fetch
application/json 3.85.189.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.85.189.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

416d36b86f10394d15200eca044aadbd545d574dfd856c1c50cbd7fb5d2a4a04

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 414
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 414 B
608 B 276ms
115ms Fetch
application/json 3.85.189.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.85.189.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

c268ba624d7b680a000c2ea2350113b5c7d92a145df73e49caf02babd2172ab1

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 251
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 589 B
757 B 495ms
335ms Fetch
application/json 3.85.189.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.85.189.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

0bd88c63470c9c2155f8d8f20102baca2e2e1eca2cb09062a269f534cc560275

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 401
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 8 KB
2 KB 205ms
160ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68d4dc055611bb515058b29d49b64cdf01a078761eae40bb5d618914c9493296

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rv17Sw%2BAUVxl73WC4Rr6P1rvIMZ4Q3P6Jf%2BtcZWCUt09br1WH49PuGJ0i3koQL0CigaQjr0vLmoXOkFY3BgjTdalUfYhZ%2Fn1TEI041xafkfB%2FOiNQ2SAEt18QGHTuZXogIW2WYst"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93540062cb1a3987-YYZ
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 542ms
401ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 24 Apr 2025 07:49:00 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 548ms
409ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 24 Apr 2025 07:49:00 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 581ms
440ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 24 Apr 2025 07:49:00 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 534ms
394ms Fetch 45.55.100.180
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.100.180 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 24 Apr 2025 07:49:00 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
360 B 569ms
379ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: fc04b7958a25dc88a658ca3410a763256d3538cb10ab58c07e0f8fa23c0ff210

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 139.28.218.139
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/plain
vary: Origin

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 25 B
312 B 296ms
110ms Fetch
application/json 74.119.117.5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

247158a0e636d47a10ce949afa6d2169eb9127a31039e913fc58fce01cec78bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 493 B
2 KB 290ms
107ms Fetch
application/json 68.67.181.248
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.248 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

d20a253a62f60758ec3289f555b6c5afad27d0c6284cd76238edd8e1cb98d744

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: ac2f23e0-a1ee-4b9d-83ef-1e8ce5951d1b
content-length: 493
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 34 B
320 B 443ms
270ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ec5130cdab33b41bf5667d523c8ce1983b8b7250875c91a47b37b7df72d1ad7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 07:49:00 GMT
server: nginx

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 404ms
234ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-222-148-106.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-auction-status: 29, 29, 29
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 12 KB
5 KB 290ms
119ms Fetch
application/json 74.119.117.12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=88667312829&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a3fb6d3cfe7f3590b2a3092b9e2a09279f4f4f1e518e9a99c7cf1b8b05fca6c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
244 B 235ms
66ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 85 B
624 B 203ms
43ms Fetch
application/json 3.168.102.9
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-9.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 1427dac313f739bf9efaf3ecefeb3d6552a38799cb03c12c98b42220a2f6ec02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 7f9811832df4c0ab77fe1a54ea6ba566.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 110
x-amz-cf-id: pxZimBqS_0aVNpZ5rdueOMomN1Of8-fHyTItBunNgKbzBcEh5LDV7A==
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 145 B
617 B 473ms
316ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e20a1dcb180314d20db2cc9b031347c02cb76ec0dbb1e57d0a3763304c7b3749

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 93540063c9ff398d-YYZ
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 690 B
1 KB 223ms
117ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.themccuskers.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=1df44a8c-1775-4cfe-88c7-588126c1479c&l_pb_bid_id=12818632635423d88&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=2f99df25-d63c-4e7a-98ad-09cefa4cc862&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.43056856110581887
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 58f7744a90dd5a07ecdb7d236bc767774921db8e842bca4a2315c6650b80a2b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 522 B
858 B 222ms
116ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.themccuskers.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=1df44a8c-1775-4cfe-88c7-588126c1479c&l_pb_bid_id=1290efd7a18b86478&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=9e31f406-86f9-4ce2-9bd4-40ba60c2c5fa&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.5471964456303761
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 1e6b92be025f2254233029ab614544c7e8bf335b197d2ae8a704a7520fce1e26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 522
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 528 B
1 KB 207ms
101ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.themccuskers.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=1df44a8c-1775-4cfe-88c7-588126c1479c&l_pb_bid_id=130574a0c83a8b7c&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=58d0c2a3-8c56-4bf5-9ad6-605968b5a44d&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.18188927170666314
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 8dcff06c06f86d80a3e065b579b73e03607b4bb142685d9fbb8cf04e7570af94

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 528
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 528 B
866 B 206ms
102ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.themccuskers.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=1df44a8c-1775-4cfe-88c7-588126c1479c&l_pb_bid_id=131f991e7404d7a28&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=517de07f-024b-491a-a20d-82521b90626e&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.9651637475798406
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 2fa9937253ee5197a5c72702c7dd68fb6430a94b1f4925b69e3ba4aada26b1c8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 528
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 236ms
94ms XHR
application/json 67.72.99.178
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.72.99.178 Ashburn, United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad05-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 24 Apr 2025 08:19:00 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: origin
server: nginx

GET
H3 200 AGSKWxW3i3saI_CmIWm6Plp2o1_0vAN6kL8U5Qkf9FsMqcee82dr-gelMLJlWRG3X878iV7E9_K3v_qZ_yKaQKg0mWmdwStwvJtB1jAhi1k5uEgGq-SfabIajXeVg2ZIGKoz37a5VQnHyA== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 86ms
85ms Script
application/javascript 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW3i3saI_CmIWm6Plp2o1_0vAN6kL8U5Qkf9FsMqcee82dr-gelMLJlWRG3X878iV7E9_K3v_qZ_yKaQKg0mWmdwStwvJtB1jAhi1k5uEgGq-SfabIajXeVg2ZIGKoz37a5VQnHyA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NDgwOTQwLDY5MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5XSxudWxsLDIsbnVsbCwiZW4iXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ5bjE2N1V5NnhHSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LnRoZW1jY3Vza2Vycy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

e2.ycpi.vip.nya.yahoo.com

Software

ESF /

Resource Hash

cbc0e5968a934a74f1d8a72365e1aa1b584782a89101a3ba22aaec63b8d12271

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-HzD_KMVtYsi2cOkJKkVrcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw0ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuujbdYDwFxs_Zt1m4gFuLmeHNz-QE2gRe_b5spaSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRqYGBnqGRjEFxgAAIfPP8o"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-HzD_KMVtYsi2cOkJKkVrcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 189ms
92ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 198ms
90ms XHR
application/json 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 6C43 16 KB
6 KB 120ms
59ms Document
text/html 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 24 Apr 2025 07:48:59 GMT
server: Kestrel
server-processing-duration-in-ticks: 649292
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 174ms
87ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250415.1/main.f49d9d120d738f961843.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=Mm5sS0NSRVNhRUJObEJWRkpqckVhNjBBaF9VbGdYcXNIaWZjZEE0VEtuY2c&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=Mm5sS0NSRVNhRUJObEJWRkpqckVhNjBBaF9VbGdYcXNIaWZjZEE0VEtuY2c&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEIPBPydTLz6prImpHvK9UiQ&google_cver=1

70 B
440 B

33ms
32ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEIPBPydTLz6prImpHvK9UiQ&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 24 Apr 2025 07:49:00 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEIPBPydTLz6prImpHvK9UiQ&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=0d6ee0ad-71da-4a47-b470-200f01f07af1&bid=1e2n4ou

70 B
440 B

153ms
88ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=0d6ee0ad-71da-4a47-b470-200f01f07af1&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 24 Apr 2025 07:49:00 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=0d6ee0ad-71da-4a47-b470-200f01f07af1&bid=1e2n4ou
content-length: 191
date: Thu, 24 Apr 2025 07:49:00 GMT
server: Kestrel

GET
H2 204 cms
ups.analytics.yahoo.com/ups/58773/ 0
160 B 602ms
297ms Image
text/html 69.147.82.61
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.82.61 New York, United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 24 Apr 2025 07:49:00 GMT
age: 0
content-type: text/html
server: ATS
referrer-policy: no-referrer-when-downgrade

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4292834802220618442&newuser=1&referrer_pid=m51mh00

70 B
440 B

201ms
141ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4292834802220618442&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 24 Apr 2025 07:49:00 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4292834802220618442&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 24 Apr 2025 07:48:59 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=759466302077987610&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

198ms
197ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=759466302077987610&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 24 Apr 2025 07:49:00 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=759466302077987610&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 26203742-585e-45ac-ad75-b260fcafca28
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 j Show response
rp.liadm.com/ 13 B
380 B 343ms
93ms Fetch
application/json 54.211.140.246
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp.liadm.com/j?dtstmp=1745480940210&did=did-0046&se=e30&duid=8e413bd09c43--01jskcay45cjtg4kreqh8qw10v&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.themccuskers.com%2F&cd=.paint.toys
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.211.140.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-140-246.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 4f2d30d3-6381-4014-a1cf-be9efad4b445
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 13
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8897 20 KB
7 KB 48ms
47ms Document
text/html 23.45.193.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.193.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-193-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=66944
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: Fri, 25 Apr 2025 02:24:44 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 34ms
33ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 24 Apr 2025 08:04:00 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 24 Apr 2025 07:49:00 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 617ms
226ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Resource Hash

7131e08a3cc430da9870569bb79c5900915918a642444506447efd608ba8b8f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
706 B 78ms
47ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 46983149202d844a57698d27aaf3591ad49ebaef7a8a14f6521e10077b09e8f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 75ms
44ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 61ms
31ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 77ms
46ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

POST
H3 200 879342d9d1fe3888c08497c7a5957f76a72a68b61ec37169ce75214a6b47cf8bf0 Show response
faucetfoot.com/create/ 301 B
325 B 138ms
65ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/create/879342d9d1fe3888c08497c7a5957f76a72a68b61ec37169ce75214a6b47cf8bf0

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/6cda37ed9d64730fff14a98136392a11488392821de688ff.v1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

923775c42cc61a637ea6c409eab811e3ebe8d99de58cba284c83b9795d88670c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-central1-test-d239.gce-us-central1, 1.1 google
expires: Thu, 24 Apr 2025 07:48:59 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504220101/ 63 KB
22 KB 49ms
39ms Other
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504220101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

960cda59b77c5e6e2d7a875dc9002bcf3e1b173a0bf6c684eacb86f1606870f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 16533559724849202485
age: 48554
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 18:19:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 23 Apr 2025 18:19:46 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 22909
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504220101"

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 681ms
416ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 9dc23be7b9bbeaade6795cb83dc67d891e29e177ce2aa25e5fc7faa8d192c058

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: application/json
x-cloud-trace-context: f47bfbca5937cf2c68babc9fc0317aea
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 6C43 436 B
935 B 31ms
31ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

40f3dea381a01e2f7b2a925eb2a5732cb37cd04821b591e2ba1fbc100d1cd86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1175227
expires: 0
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame D94F
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%2...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_conse...

2 KB
1 KB

55ms
55ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 523a4f1208582a00acc8f220404f91dfae5481b31b5c63121e6a6d16f6ca3952

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 935400678bb936d8-YYZ
content-encoding: br
content-type: text/html
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NT%2B%2FWesq3bCY42XFQe2j%2Bg8UOSMD6%2F8OOH%2F6%2BBZFWd7wCpI9ToEX6M2ckHLvHKm6%2F%2FjTfedfIfG1OGixmot%2BViMO5Zvw5YUvPTrvK6qxcWfC5xVGH%2Bqw6uzClD02o0v6MHIlU8PKymmjXg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 935400664ad736d8-YYZ
content-length: 0
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W86kE1xBLFtPdDter%2Fh4zSvyY4rsE8Y6Z2Ui5LCOVy4neL8HUNjfUuzH5Bp7Cumj7VYDMhO4awy%2Bo1l75PUGwL%2BQ9hNTfT843o7OHPL4N%2Bk2vj8mLgKx4hR1qws9wnMYe9mB5SMSjP8%2FOA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET bounce
id5-sync.com/ 0
0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 685ms
243ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

aa709de93fc916339ba19ee8930814fa1677c3268a99be7ade8116cb9e64aea6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 8897 2 KB
3 KB 240ms
34ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=4380917&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 3a077619843ea35b1df003a647d795eda3dac16f6e6df39542ea3ccad276ec91

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 33ms
32ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=969079db-ca1c-4592-b0a8-2f051850b4b6&ccsid=23c9c267-652d-4eb6-9423-e88e4b9a9109
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 14 KB
4 KB 49ms
48ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: eaa7e3d32d237bf9271ddb57b4068ec273bea7ce8efcf3b3eb36f3b6b5b31206

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
3 KB 457ms
457ms Fetch
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6968168474204989&correlator=4286575498146381&eid=31091756%2C31091935%2C83321073&output=ldjh&gdfp_req=1&vrg=202504210101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745480940576&lmt=1745480940&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.themccuskers.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDUxZTBiYzhkLTU0MzQtNDI5ZC05MzI0LThiZWY2MGIyYTNlNFgBEjcKDWJpZHN3aXRjaC5uZXQSJGI0Y2RmOTA5LWFlZmYtNGZiZC04MzhkLTQ4ODU1ODRmOWQ3MlgBEjYKDHB1Ym1hdGljLmNvbRIkMUIwQTY3NjMtQTk3Mi00RTMzLUIxQ0EtNzAwNjkzQjBERjJGWAESPwocbGl2ZWludGVudC5pbmRleGV4Y2hhbmdlLmNvbRIdWm9XQUVOSE02dDBBQURKbkFPaEtVQUFBJjM4NTlYARInChJydWJpY29ucHJvamVjdC5jb20SD004U1VSQ0lELTktQVhGWVgBEh0KDmVzcC5jcml0ZW8uY29tGKfylbbmMkgAUgIIZBIYCgl5YWhvby5jb20YzvSVtuYySABSAghvEhQKBW9wZW54GLj0lbbmMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Yp_KVtuYySABSAghkEhcKCHJ0YmhvdXNlGKbylbbmMkgAUgIIZBJTCg1jcndkY250cmwubmV0EkBhMmE5ZGUxNWI1MTFlZWE2MTJiMDgyYThlOTk0MTg1Y2EwMmM0NGQ0ZmI0MjZiYjM1MmQ2NWQzZjE4ZmQyYWIzWAESMwoJb3BlbngubmV0EiRlMmIzNjc2NS1jOWMzLTQ1NGMtYjhmNC02NzhkMWQ5MjMwOGRYARKHAQoObGl2ZWludGVudC5jb20SczE0LUFFdmpQekVRMEVlRktQWk9zUlEwWWVRRVRBZ1VHaENYTTdlbmo2N0o4UE8ra2t0ZzJqSXBmNzY1anF6aXVqdkpLVXFIRkJLUFIvNmRHWFlDSzliblJLZnJjM0c3SWxKL09xL1pEZVVpWjF3VjZnPT1YARI1ChlsaXZlaW50ZW50LnRyaXBsZWxpZnQuY29tEhYyNDYwMzQ1NDkwMjgxMTI4NDE0ODM2WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745480938046&idt=875&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dtrue%26custom_path%3D160x600%26lld_id%3D590bc00c76664677b8e4d51138510efe80939678%26price_floor%3Dna%26amznbid%3Dmfdb0g%26amznp%3Dioiscg%26amzniid%3DJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D469762048%252C218890240%26cc-iab-class-id%3D482%252C283%26cc-iab-name%3DShopping.Children%27s%2520Games%2520and%2520Toys%252CHome%2520%2526%2520Garden.Interior%2520Decorating%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.themccuskers.com%252F%26tyche_code%3DV.20250415.1%26pageos_code%3DV.20250415.1%26config_id%3D1024872_74068_primary_config%26hour%3D0%26day%3DThursday%26referrer_domain%3Dqwxz.themccuskers.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250415.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=49777&tan=1e70dcf7-36bf-45e9-8b8b-41914041268a&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9f15618638c48e31ede8cbb180a81eb0f95757e22555917674181c6df45410d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 4727305863
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138237858944
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 3211
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
39447b09961d85685c0a38d8b79d69f5.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame D5A6 7 KB
3 KB 110ms
47ms Document
text/html 142.250.80.65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://39447b09961d85685c0a38d8b79d69f5.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.65 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: Thu, 24 Apr 2025 07:49:00 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 66ms
32ms Image
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=cb5f66c8-8d8c-4f76-8cee-193c66a81c14&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qwxz.themccuskers.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=8f0dcdb7-07e9-4c89-a1ac-050e7aabfb3e&ccuid=969079db-ca1c-4592-b0a8-2f051850b4b6&sid=23c9c267-652d-4eb6-9423-e88e4b9a9109&nct=1745480940000&r=https%3A%2F%2Fqwxz.themccuskers.com%2F&ns=true&lang=en-CA&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&devicefp=139.28.218.139%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=c6213bd0-8738-47d7-9af7-99e87b2b1117&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Thu, 24 Apr 2025 07:49:00 GMT
content-length: 0

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame DA0E
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=

35 B
591 B

34ms
32ms

Document
image/gif

185.167.164.38
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 24 Apr 2025 07:49:01 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 3A67
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

57ms
56ms

Document
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

e2.ycpi.vip.nya.yahoo.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 24 Apr 2025 07:49:01 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 322NGJ1Y4MMP3KNRR2WE

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:01 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 29ACJQ3ZC84P8WTZ0SPC

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1950
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=759466302077987610&gdpr=0&gdpr_consent=

42 B
448 B

94ms
39ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=759466302077987610&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 24 Apr 2025 07:48:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: f6778177-265a-48fe-a1b7-32c4732f820c
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=759466302077987610&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame D7F7 0
838 B 108ms
59ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 935400683ad339f4-YYZ
content-encoding: br
content-type: text/html
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H2

200

sync
pippio.com/api/ Frame 8897
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEQ0Q0U2NUI0LTY4MUQtNEI4Ri1CNkVGLTJERjdFMzM5RDgxRRAAGg0I7NmnwAYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=08a73c6026371c8ea77db8199534489b7cfc48950b6f0f9496ff0750626fee30791426b5417dce21&_=2

42 B
571 B

191ms
102ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=08a73c6026371c8ea77db8199534489b7cfc48950b6f0f9496ff0750626fee30791426b5417dce21&_=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&it=1&iv=08a73c6026371c8ea77db8199534489b7cfc48950b6f0f9496ff0750626fee30791426b5417dce21&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT

GET
H2

204

cms
ups.analytics.yahoo.com/ups/58679/ Frame 8897
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=0d6ee0ad-71da-4a47-b470-200f01f07af1&icm&gdpr=0&gdpr_consent=&cver
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0

0
40 B

165ms
164ms

Image
text/html

69.147.82.61
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

69.147.82.61 New York, United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 24 Apr 2025 07:49:02 GMT
age: 0
content-type: text/html
server: ATS
referrer-policy: no-referrer-when-downgrade

Redirect headers

strict-transport-security: max-age=31536000
cache-control: no-store
location: https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
content-length: 257
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html
content-language: en
server: ATS

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame 8897
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&sInitiator=external&gdpr=0&gdpr_consent=

42 B
604 B

45ms
44ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 11
Pragma: no-cache
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Length: 42
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 0
Pragma: no-cache
Connection: Keep-Alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 8897
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RDRDRTY1QjQtNjgxRC00QjhGLUI2RUYtMkRGN0UzMzlEODFF&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELgqVAVYkjXt8yXf023ygFU&google_cver=1

42 B
529 B

194ms
38ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELgqVAVYkjXt8yXf023ygFU&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 01:43:10 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELgqVAVYkjXt8yXf023ygFU&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8897
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=1M5ltGgdS4-27y334znYHg%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESECFZVDyrfZS3qi3xdmnrD9Q&google_cver=1

20 KB
20 KB

47ms
47ms

Image
text/html

23.45.193.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESECFZVDyrfZS3qi3xdmnrD9Q&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.45.193.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-193-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=66944
content-encoding: gzip
expires: Fri, 25 Apr 2025 02:24:44 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 24 Apr 2025 07:49:00 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESECFZVDyrfZS3qi3xdmnrD9Q&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 8897
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELgqVAVYkjXt8yXf023ygFU&google_cver=1

42 B
379 B

231ms
34ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELgqVAVYkjXt8yXf023ygFU&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 01:44:05 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELgqVAVYkjXt8yXf023ygFU&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 8897
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:D192F3DBA01445EB85AFED28BB6B85E2

42 B
328 B

153ms
38ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:D192F3DBA01445EB85AFED28BB6B85E2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 01:36:53 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:D192F3DBA01445EB85AFED28BB6B85E2
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 23 Apr 2025 07:49:00 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 8897
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=

42 B
390 B

164ms
41ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=
content-length: 355
date: Thu, 24 Apr 2025 07:49:00 GMT
server: Kestrel

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58292/ Frame 8897 0
160 B 640ms
319ms Image
text/html 69.147.82.61
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.82.61 New York, United States, ASN14779 (YAHOO, US),

Reverse DNS

e2.ycpi.vip.nya.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 24 Apr 2025 07:49:01 GMT
age: 0
content-type: text/html
server: ATS
referrer-policy: no-referrer-when-downgrade

GET
H2 200 D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 8897 43 B
520 B 418ms
98ms Image
image/gif 3.213.243.160
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.243.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-243-160.compute-1.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 8897
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=272289c1-f149-42b2-8a3d-50b867952af3&gdpr=0&gdpr_consent=

1 B
334 B

36ms
33ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=272289c1-f149-42b2-8a3d-50b867952af3&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 01:26:29 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: c56d5273-f547-4aa9-a25a-bdcd53ac3bf2
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=272289c1-f149-42b2-8a3d-50b867952af3&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame D94F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAns7NHM6ucAACBYAJvLxgAADx0AAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAns7NHM6ucAACBYAJvLxgAADx0AAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

58ms
57ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAns7NHM6ucAACBYAJvLxgAADx0AAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 1CFKY91MS6PNXVZ9KB1S
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAns7NHM6ucAACBYAJvLxgAADx0AAAIB&gpp=&gpp_sid=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 0EHAR9GDS6PX5XXPA62E
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 24 Apr 2025 07:49:01 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2

204

CookieSyncThrotle
rtb.adentifi.com/ Frame D94F
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aAns7NHM6ucAACBYAJvLxgAA%263869&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=c3aaff32-6516-4d9d-ab54-d6cd4f4a6638&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=c3aaff32-6516-4d9d-ab54-d6cd4f4a6638&vxii_pid=12&vxii_pid1=7006&vxii_rcid=4d00f6cc-f52f-48fe-895c-7e7422f41a3f&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=4d00f6cc-f52f-48fe-895c-7e7422f41a3f
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=0d6ee0ad-71da-4a47-b470-200f01f07af1
https://rtb.adentifi.com/CookieSyncThrotle?

0
163 B

187ms
87ms

Image
text/plain

44.205.176.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncThrotle?
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H2
Server: 44.205.176.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-176-107.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

date: Thu, 24 Apr 2025 07:49:01 GMT

Redirect headers

location: https://rtb.adentifi.com/CookieSyncThrotle?
content-length: 66
p3p: CP="NOI OUR BUS UNI COM NAV"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html; charset=utf-8

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame D94F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAns7NHM6ucAACBYAJvLxgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGyJUwnJ00rZxmFXiPamXiQ&google_cver=1

43 B
764 B

77ms
77ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGyJUwnJ00rZxmFXiPamXiQ&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A6SVN%2Fy3dA3Z82qDz3sKBqEbKkL0vLnwfc42buNOAA0szZSOB4w68RfNxAgiPdI4lMlLGbd4JhwGq%2BpvBFwASElDTOfjuBMgy09eHpa63tDwk2WZlVjjpckPWT5rApnPbLY7ySBDeLJ3vg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 935400696cfd36d8-YYZ
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGyJUwnJ00rZxmFXiPamXiQ&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame D94F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aAns7NHM6ucAACBYAJvLxgAADx0AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFUgj56dYt207XKlIOas6mY&google_cver=1

43 B
771 B

61ms
60ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFUgj56dYt207XKlIOas6mY&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7edAmbIY%2FFyo%2FazUvfi%2B8c8bvQdnILXuBQtgQ3Gochwjp1nFXqD%2BiAHL3UKZZECBZoFo80I3YCMqN7CpnjwPRD8I%2FRf%2F6ZXPgCWAveGVfvoY%2FMs0WGlyRDeLIjv2d9Vaq3IJB67qYE8JQw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93540068fcb036d8-YYZ
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFUgj56dYt207XKlIOas6mY&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 364
date: Thu, 24 Apr 2025 07:49:00 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame D94F
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=3129260950073529854&gdpr=0&gdpr_consent=

43 B
764 B

55ms
52ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=3129260950073529854&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cqpnhn6UhhZCRl2uVf9KrvGikSPTTGBYtul2Y479tkkiX%2FiH%2BJd7SSskba7oNu7LIFYAALkFZANFuxOHcUERbSX9PYMUwytlOr2OskCQu20o%2BFlAfaXQW0S9zc1iPhyK9fhSJKHThXdfIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9354006a2d7936d8-YYZ
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache,no-store
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=3129260950073529854&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 24 Apr 2025 07:49:00 GMT
pragma: no-cache

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D94F
Redirect Chain

https://s.c.appier.net/index?userId=aAns7NHM6ucAACBYAJvLxgAA%263869&gdpr=&us_privacy=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=fH4ahZ52A82xO33y7ewJaA&gdpr=0

43 B
766 B

54ms
54ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=fH4ahZ52A82xO33y7ewJaA&gdpr=0
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cAyPB486W1%2FAkE4pbZZYnb6D4wFAgJ0U%2FyUh8eqFr8tjbjA7uG2%2BQS7%2BIKuK4nKlreXZ7ZI7rk4nZkfcL19GgAL1RCoknFE8GQg6AMFGmPNZZLoXEr2ow4s%2BGB2K9JbpQem5gfTYjstttA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9354006cff0b36d8-YYZ
content-length: 43
server: cloudflare

Redirect headers

Cache-Control: no-store
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=fH4ahZ52A82xO33y7ewJaA&gdpr=0
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 24 Apr 2025 07:49:01 GMT
Server: nginx

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame D94F
Redirect Chain

https://dsp.360yield.com/dsp_match/275?ssp=10&gdpr=&gdpr_consent=&r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D15%26external_user_id%3D%7BDSP_USER_ID%7D&userId=aAns7NHM6ucAACBYAJvL...
https://dsp.360yield.com/ul_cb/dsp_match/275?ssp=10&gdpr=&gdpr_consent=&r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D15%26external_user_id%3D%7BDSP_USER_ID%7D&userId=aAns7NHM6ucAAC...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=af27efce-ec3d-436a-ac8e-1ffdb3b5ee09&gdpr=&gdpr_consent=&userId=aAns7NHM6ucAACBYAJvLxgAA%263869&us_privacy=

43 B
765 B

62ms
56ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=af27efce-ec3d-436a-ac8e-1ffdb3b5ee09&gdpr=&gdpr_consent=&userId=aAns7NHM6ucAACBYAJvLxgAA%263869&us_privacy=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1zTVn9gZdZNnWQ5cnPTjpGi8lhdBsQpoNweRezgqQBlJ4HUK8CB6o76HWLrq2GZ5NwqkMzhuqUhYiccrPW6Zjcom%2F7WPjQQ86Mot5OSakdnPkqdTtFlMvcDWRyBWdVBXz%2FXASfW%2FJWkBrg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9354006b3e1136d8-YYZ
content-length: 43
server: cloudflare

Redirect headers

access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=af27efce-ec3d-436a-ac8e-1ffdb3b5ee09&gdpr=&gdpr_consent=&userId=aAns7NHM6ucAACBYAJvLxgAA%263869&us_privacy=
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/plain

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame D94F
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?puid=aAns7NHM6ucAACBYAJvLxgAA%263869&cb=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fexternal_user_id%3D_ZUID_&gdpr=&gdpr_consent=&us_privacy=
https://b1sync.outbrain.com/usersync/index/?cb=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fexternal_user_id%3D_ZUID_&gdpr=&gdpr_consent=&puid=aAns7NHM6ucAACBYAJvLxgAA%263869&s=2&us_privacy=
https://b1sync.zemanta.com/usersync/index/?cb=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fexternal_user_id%3D_ZUID_&gdpr=&gdpr_consent=&obuid=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&puid=aAns7NHM6...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&puid=aAns7NHM6ucAACBYAJvLxgAA&3869

43 B
766 B

66ms
63ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&puid=aAns7NHM6ucAACBYAJvLxgAA&3869
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FxlejxCqNqp8qBtIVkVj28N3dmRSOTWkrQHBzCagMTjDxj62Jkoc5lsp44Vlx36lggCDmgv%2Fmi4jbFb%2FlPNB4uOr8Rh2wpKlbXQm%2BoJV40lCTxmGDgs4U51toTCGSEUClXm6KuH2sI%2F2w%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9354006bee6c36d8-YYZ
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&puid=aAns7NHM6ucAACBYAJvLxgAA&3869
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 174
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html; charset=utf-8

GET
H3 200 setuid
prebid.intergient.com/ Frame D94F 0
791 B 107ms
74ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aAns7NHM6ucAACBYAJvLxgAA%263869
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745480940&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SRvGph98O9tRmnbQsyAoqqn9hjxnQM8Ec%2FUfYACttTQ%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 935400683ad139f4-YYZ
server: cloudflare

GET
H3 200 _ Show response
fundingchoicesmessages.google.com/f/AGSKWxUkTfw_8vFHk6kUolOzQ7RXMiV3UprTl_1KGXXOO2SWTDMM7Q5b_PrIOl7DunnJ1kk4M8j_ze_w8ZDfEgckpV33grj3VUJMsXn3j2Y8tpTpr62Dn27s-QMjS_sph1R-40h8AXkRD6qDBnWeaHmyogYbjtnWc... 54 B
109 B 74ms
73ms Script
application/javascript 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUkTfw_8vFHk6kUolOzQ7RXMiV3UprTl_1KGXXOO2SWTDMM7Q5b_PrIOl7DunnJ1kk4M8j_ze_w8ZDfEgckpV33grj3VUJMsXn3j2Y8tpTpr62Dn27s-QMjS_sph1R-40h8AXkRD6qDBnWeaHmyogYbjtnWcvpTIoxnwkcnYVy0V4aq2aVIwZpf59cE/_?handler=ads&_468x100./webads._370x270.-widget-advertisement/

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.yn167Uy6xGI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxB4EEYpDjr-iyjaCleSImEglcNUQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2e3c20a293d9cd925c96b78496df8c15786be7a2e4b340ea33e080745993fc5b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xvd7gJKQ0FDECovWLhmOeA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw0ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuujbdYDwFxs_Zt1m4gFuLheHNz-QE2gRctTaeYlTSS8gvjk_PzSooyk0pL8ovSktNSi1OLylKL4o0MjEwNTIwM9QwM4gsMAK5tP5I"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xvd7gJKQ0FDECovWLhmOeA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
52 KB 243ms
78ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.yn167Uy6xGI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxB4EEYpDjr-iyjaCleSImEglcNUQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc9d26c848e1a45631cea46432d63f393bdb4bd929a9403d5608c5eca09b1fc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 11831852576883681268
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 07:49:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52766
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxVUg5XXnHGehEcPdbr-OpG_EFh1bwlQ_7VOV_9oDsHpcV0pNnQFXqoPFlcKKmUp7h411kfqHgTktfBD1eLjkqJxyWSJ8SddtUIsElI23lvts2-cGCEXMYmbraKVdnLfFVWfzT90Yw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 100ms
57ms XHR
text/html 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUg5XXnHGehEcPdbr-OpG_EFh1bwlQ_7VOV_9oDsHpcV0pNnQFXqoPFlcKKmUp7h411kfqHgTktfBD1eLjkqJxyWSJ8SddtUIsElI23lvts2-cGCEXMYmbraKVdnLfFVWfzT90Yw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-RETEvUmFzGnHdqmwUi_zJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII0JBi-FB_mfUHEAtxc7y9ufwAm8CEdZdYlFyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRoZ6BeXyBAQBG-yQq"
content-security-policy: script-src 'report-sample' 'nonce-RETEvUmFzGnHdqmwUi_zJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST 483.json
id5-sync.com/g/v2/ 0
0

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUg5XXnHGehEcPdbr-OpG_EFh1bwlQ_7VOV_9oDsHpcV0pNnQFXqoPFlcKKmUp7h411kfqHgTktfBD1eLjkqJxyWSJ8SddtUIsElI23lvts2-cGCEXMYmbraKVdnLfFVWfzT90Yw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6b8AkbHmxVxSWeK86seqtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII1pBi-FB_mfUHEAtxc7y9ufwAm0DHtffmSi5J-YXxyfl5Jal5JbqJKcW6IHZRZlJpSX4RCju1DKQiJz89PTMvPd7IwMjUwMTIUM_APL7AAABnfSSd"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6b8AkbHmxVxSWeK86seqtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8EEA 0
0 92ms
91ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJLNaFdcJll1XrKc8zPOBA28zyEMXSpYamDbxJQTDK5JLW7V2cXKRf0DWA4yRoP81yjtJ1E73FkX6DdHj8RTT7XCBt2VhaY8Da_dxDp1ljAgHTPoTLv9nGu0GHUpOZchrk9d5gtVCsewNu3fgYpkzeQntpywZJd8viQdRV3y6SIk40_8YCrAieXc_ac4xqry61xROhi3hB3YzsLibSlUnK35CV4uN1eUWBl9y1enOX8C_FTADe3H6wNsRLBej8RTQ8iSsfueCO2HHr2z9eB920CeVi6hqFdXBd5_5KFZo03HRjB9OBD3gvfDYiQPeZVGSDW3gvR5yYjSH5H8BdtEkS33LYqVt1neuNUquwNvvfx1cxHD1FZ1yrdrRHX-SrfI8M7rKg0Z2X3Y0VacOEOGXBI2zxkTVtIEr4onLJ_U3J9Q6_FzlUOLEFPGBuQIDHA1efdQdxXtBLnIt_i6o45uoG8rtiuSlHqVxcc3dxXOQj6bK1iy075mPiPRG8FMo3DNKlUi1EiHQUIWygEFy9TkjBHEkBf448aCldI4IsmbGiL3AG0h4j6P2k8ZspLFHYTaUT-J4mTNlXkf0TboS4o8UWco3iRg&sai=AMfl-YSNE5_PiNiJJ-FXltZ3I57u4yc_7NYbcQ5UqRtpbdfSCsJu8p3TJXlI_XfLSo_1H4qGP3RVmJq6LEk23xmRi22t5m-m1xQ_-KD7ul4E9eKWwAcri6Qr6CNyf8k&sig=Cg0ArKJSzHiWa2fuFM2bEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 8EEA 220 KB
68 KB 40ms
39ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a798986e0dce849145906cae97bf77a273b5ffb8880fc0f7da14eff4a9b85aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4151480097505160345
age: 2116
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 08:13:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 24 Apr 2025 07:13:45 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-7
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69290
x-xss-protection: 0
server: cafe

GET
H2

200

pd Show response
playwire-d.openx.net/w/1.0/ Frame 576F
Redirect Chain

https://playwire-d.openx.net/w/1.0/pd
https://playwire-d.openx.net/w/1.0/pd?cc=1

803 B
1 KB

41ms
40ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7e5967efca9edf7800ea97266cc5d7c2b4655152a4a58211fb400b907c41bfaa

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Thu, 24 Apr 2025 07:49:01 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 139.28.218.139

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 24 Apr 2025 07:49:01 GMT
location: https://playwire-d.openx.net/w/1.0/pd?cc=1
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 139.28.218.139

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 188A 1 KB
2 KB 154ms
47ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: cf9d16ce93891ee38838e91838a50c23d42c2ab69d530bf8f314cba65f4e30b7

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Thu, 24 Apr 2025 07:49:01 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2CB3 20 KB
7 KB 56ms
47ms Document
text/html 23.45.193.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.193.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-193-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=66943
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 24 Apr 2025 07:49:01 GMT
expires: Fri, 25 Apr 2025 02:24:44 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 3CB5 3 KB
2 KB 144ms
38ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 345
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 9354006b99a2a22f-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 24 Apr 2025 07:49:01 GMT
expires: Thu, 24 Apr 2025 11:49:01 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame B6CD 16 KB
6 KB 53ms
46ms Document
text/html 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 24 Apr 2025 07:49:00 GMT
server: Kestrel
server-processing-duration-in-ticks: 765487
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 1B53 0
0 194ms
90ms Document
text/plain 198.199.71.154
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.71.154 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 24 Apr 2025 07:49:01 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame 599A 11 KB
4 KB 149ms
75ms Document
text/html 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4&linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745480940534&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 396cc7d8c730ae32627f78b3fd94ea1bb80cc97fb4bd1712dc333861f0936ffe

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 9354006b6e20ac3f-YYZ
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 24 Apr 2025 07:49:01 GMT
expires: 0
last-modified: Tue, 22 Apr 2025 13:00:55 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 8B14 269 B
379 B 186ms
83ms Document
text/html 23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 24 Apr 2025 07:49:01 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 66D7 52 KB
17 KB 91ms
25ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 68439
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 24 Apr 2025 07:49:01 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 129029, 72577
X-Served-By: cache-lga21993-LGA, cache-yul1970030-YUL
X-Timer: S1745480941.330610,VS0,VE0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 62ms
36ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=uQPJ4l91bjBWWjRaRUcxbW9GSGtIdnBBTlFVRHREZzY1JTJCYWo3a212MnQyVTRSV2VQMEFEQzFFRVh0aklEdGNkeFRNJTJGU0Z1RjQwV1VzTkgxb2swRFVFYjR2eGpHbFdydCUyQnlTWU1HNHBOSzV5OHFiSWVCJTJGd29BZ1VxMXJqVEIlMkZnViUyRjJYVjdGb0hZQXJGYmMzNVBKZU81YjNDVGclM0QlM0Q&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 24 Apr 2025 07:49:00 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 307337
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 279ms
278ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-44-220-97-2.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
662 B 69ms
43ms Fetch
application/javascript 34.196.240.40
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.240.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-240-40.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: cf56c1e180f1111b54f59d6a17bf297fcb1398d7a34cf2bbf52433fead5f8a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 88ms
61ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&tp=YYYvHtwJoCVR%2B6ySNRj0Dnoaynvk8xqsr0DSppbyQkI%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 04e7ec0e86f1f4c820726d6379414296b00c1a0b9b5036602e8730067a6f9de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 519 B
0 20ms
20ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jskcay45cjtg4kreqh8qw10v&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-72-103.compute-1.amazonaws.com
Software: /
Resource Hash: ad776e799bf28e5e2411adc67a4e6f21495a3b440fc62374cff879fb5e012473

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 1b8d569e7061f1cb
request-time: 5
access-control-allow-credentials: true
expires: Fri, 25 Apr 2025 07:48:59 GMT
access-control-allow-origin: https://paint.toys
content-length: 519
date: Thu, 24 Apr 2025 07:48:59 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 432 B
1 KB 39ms
31ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d0d823c582d131f5bb35d7e377af46094f4547d73d272112071f909d141c6fb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 780409
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

ibs:dpid=903&dpuuid=0d6ee0ad-71da-4a47-b470-200f01f07af1
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=0d6ee0ad-71da-4a47-b470-200f01f07af1

42 B
715 B

49ms
44ms

Image
image/gif

44.220.97.2
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=0d6ee0ad-71da-4a47-b470-200f01f07af1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

44.220.97.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v076-0aec9938a.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: 29zeufMZTSk=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=0d6ee0ad-71da-4a47-b470-200f01f07af1
content-length: 189
date: Thu, 24 Apr 2025 07:49:01 GMT
server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=

68 B
323 B

417ms
304ms

Image
image/png

54.211.170.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.211.170.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=
content-length: 323
date: Thu, 24 Apr 2025 07:49:01 GMT
server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-9540501e-561b-52d9-625f-06d5f8151d40$ip$139.28.218.139&gdpr=0&gdpr_consent=

68 B
323 B

315ms
274ms

Image
image/png

54.211.170.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-9540501e-561b-52d9-625f-06d5f8151d40$ip$139.28.218.139&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.211.170.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Location: https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-9540501e-561b-52d9-625f-06d5f8151d40$ip$139.28.218.139&gdpr=0&gdpr_consent=
Content-Length: 201
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

redir
rtb-csync.smartadserver.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFHZW9rN1FFOW9BQUJvaHo2WFhsdw&gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Csas%2Cpp%2Cshr&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Csas%2Cpp%2Cshr&bee_sync_current_partner=adx&bee_sync_initiator=shr&bee_sync_hop_count=1
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGeok7QE9oAABohz6XXlw&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpp%2Cshr&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
https://rtb-csync.smartadserver.com/redir?partneruserid=AAGeok7QE9oAABohz6XXlw&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cshr%26bee_sync_curr...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cshr&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=3129260950073529854&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?ev=AAGeok7QE9oAABohz6XXlw&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D3129260950073529854%26gdpr%3D0%26gdpr_consent%3D%26bee_...
https://match.prod.bidr.io/cookie-sync?userid=3129260950073529854&gdpr=0&gdpr_consent=&bee_sync_partners=shr&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAGeok7QE9oAA...
https://match.sharethrough.com/sync/v1?source_id=vyXkw8rSq3j4JmKvTgxR3x1c&source_user_id=AAGeok7QE9oAABohz6XXlw&gdpr=0
https://match.prod.bidr.io/cookie-sync/sas?gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAGeok7QE9oAABohz6XXlw&partnerid=127&gdpr=0

43 B
334 B

41ms
39ms

Image
image/gif

23.105.12.120
LEASEWEB-USA-WDC

General

Check archive.org

Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AAGeok7QE9oAABohz6XXlw&partnerid=127&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.105.12.120 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 24 Apr 2025 07:49:02 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://rtb-csync.smartadserver.com/redir?partneruserid=AAGeok7QE9oAABohz6XXlw&partnerid=127&gdpr=0
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:02 GMT
Server: gunicorn
Connection: keep-alive

GET sync
ssbsync.smartadserver.com/api/ 0
0

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 322ms
127ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=&__qcmcs=1
https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=mMw0ncuXYcCDwzaWlsEpks-WYJaDlT3FncYGXTf1

68 B
324 B

121ms
119ms

Image
image/png

54.211.170.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=mMw0ncuXYcCDwzaWlsEpks-WYJaDlT3FncYGXTf1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.211.170.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

strict-transport-security: max-age=86400
cache-control: private, no-store, proxy-revalidate
location: https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=mMw0ncuXYcCDwzaWlsEpks-WYJaDlT3FncYGXTf1
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8EEA 0
0 62ms
59ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8EEA 0
0 57ms
53ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200 admi Show response
aax-us-east.amazon-adsystem.com/e/dtb/ Frame AD5D 22 KB
8 KB 176ms
71ms Document
text/html 52.46.145.180
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.46.145.180 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

669da75032eaad3ed28cdde0874c86f67b656b944ed0d9ad117a0439e06e899a

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-store, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 7769
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Apr 2025 07:49:01 GMT
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: NNP12BTYKC5VPEGDZQ8Q

GET
H2 200 csm_othersv6.js Show response
c.amazon-adsystem.com/bao-csm/direct/ Frame 8EEA 58 KB
18 KB 41ms
36ms Script
application/javascript 3.171.136.233
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/direct/csm_othersv6.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.136.233 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-136-233.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 94a26e328e233d2c4b23f966f0836d1974b8b1db6ede373bbf9d9e97f478239b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
etag: 196984c43b1ab892e77abe088cd8e908
x-amz-version-id: OeXgj4YNXyQTnc10Ga6Yodj5EFhXuwxX
age: 63396
x-cache: Hit from cloudfront
x-amz-cf-id: uOQLQS9plopaHh9IK7dj0JdGY_c1AVfoatnA1ugMblq-qyOVJFuthg==
date: Wed, 23 Apr 2025 14:12:25 GMT
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
via: 1.1 168a3079f6c62f465885c1d82b0b1d5c.cloudfront.net (CloudFront)
accept-ranges: bytes
x-amz-rid: 0DPZW7NE6NDBAXDTMK0C
x-amz-cf-pop: JFK52-P8
server: Server
x-amz-server-side-encryption: AES256

GET
DATA 200
OK truncated
/ Frame 8EEA 218 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a59fe436be6264fe61eea4c457211f47079ca668257991e6c7c5c14d7b923511

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUg5XXnHGehEcPdbr-OpG_EFh1bwlQ_7VOV_9oDsHpcV0pNnQFXqoPFlcKKmUp7h411kfqHgTktfBD1eLjkqJxyWSJ8SddtUIsElI23lvts2-cGCEXMYmbraKVdnLfFVWfzT90Yw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xMDda4gFbmUHFYrNjjoH5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0JBi-FB_mfUHEAvxcLy9ufwAm8COBfufMCq5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI0M9A_P4AgMAkOMlCw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xMDda4gFbmUHFYrNjjoH5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUg5XXnHGehEcPdbr-OpG_EFh1bwlQ_7VOV_9oDsHpcV0pNnQFXqoPFlcKKmUp7h411kfqHgTktfBD1eLjkqJxyWSJ8SddtUIsElI23lvts2-cGCEXMYmbraKVdnLfFVWfzT90Yw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-coJB1q22BxLoPZhpQtlbBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw15Bi-FB_mfUHEAvxcLy9ufwAm0BH77ynjEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDEyFDPwDy-wAAAc9Qkpw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-coJB1q22BxLoPZhpQtlbBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxV8X423iJP49u0x7CAS2VJlbPCicMft5haK8Gd6pGRUfGL-jPPO1wTGxwkn2enQwUyv4IylZkbBVrwcFsn3Uri0dcBhdH4JDcw4oNinLL1lBm6LU8vYGPyFwfBRZPVqUuaCw4MwjA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 94ms
90ms Script
application/javascript 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV8X423iJP49u0x7CAS2VJlbPCicMft5haK8Gd6pGRUfGL-jPPO1wTGxwkn2enQwUyv4IylZkbBVrwcFsn3Uri0dcBhdH4JDcw4oNinLL1lBm6LU8vYGPyFwfBRZPVqUuaCw4MwjA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NDgwOTQxLDQ0MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJ5bjE2N1V5NnhHSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LnRoZW1jY3Vza2Vycy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

245255a1a320f098ebf90ff94391dfcb33f6206ddfee3705132e7d55d5d29bf1

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-SbV9oXpIqKixczWhxdP1Ow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1JBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxs_Zt1m4gFuLheHtz-QE2gROTv75iVNJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDEy1DMwiC8wAAC7cT_0"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-SbV9oXpIqKixczWhxdP1Ow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8EEA 0
0 57ms
55ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 599A 19 KB
7 KB 121ms
50ms Script
text/javascript 104.16.80.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4&linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745480940534&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.80.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 9354006d0c6f36c0-YYZ
access-control-allow-origin: *
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2

200

xuid
eb2.3lift.com/ Frame 188A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=0d6ee0ad-71da-4a47-b470-200f01f07af1&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

67ms
63ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=0d6ee0ad-71da-4a47-b470-200f01f07af1&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=0d6ee0ad-71da-4a47-b470-200f01f07af1&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 24 Apr 2025 07:49:01 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 188A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEM_BRVRL6L7i3gWHponASLU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
474 B

35ms
34ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEM_BRVRL6L7i3gWHponASLU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEM_BRVRL6L7i3gWHponASLU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 188A
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA2MzYyNTc5OTA1Njk4MTM5NjIwMA%3D%3D

170 B
188 B

49ms
48ms

Image
image/png

142.250.65.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA2MzYyNTc5OTA1Njk4MTM5NjIwMA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

142.250.65.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA2MzYyNTc5OTA1Njk4MTM5NjIwMA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:01 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 188A
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA2MzYyNTc5OTA1Njk4MTM5NjIwMA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

41ms
35ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 188A 0
651 B 185ms
99ms Image
text/plain 150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2063625799056981396200&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 04A365146A2C4D23ABBB7980A4E0C8EE Ref B: YMQ31EDGE0313 Ref C: 2025-04-24T07:49:01Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzgXN+WSqu/QjGiMA6Ag==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 188A
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=2063625799056981396200
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=c3aaff32-6516-4d9d-ab54-d6cd4f4a6638
https://p.rfihub.com/cm?pub=39342&in=1&userid=d183f6ea-712c-4bc5-9cbc-8de87e43f662%3A1745480941.8112113&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dd183f6ea-712c-4bc5-9cbc-8de87e4...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=979321856528761373&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3Dd183f6ea-712c-4bc5-9cb...
https://idsync.rlcdn.com/501709.gif?partner_uid=d183f6ea-712c-4bc5-9cbc-8de87e43f662%3A1745480941.8112113&_=1745480941.8131046
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJkqyRoHK-5ganm-wSnNJEI&google_cver=1

42 B
60 B

57ms
56ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJkqyRoHK-5ganm-wSnNJEI&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJkqyRoHK-5ganm-wSnNJEI&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 289
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

xuid
eb2.3lift.com/ Frame 188A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2063625799056981396200?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-aerlhatE2oRJlBRbhX9inWkyqv8anzUcEsM6LRBoNQ--~A&dongle=0883

37 B
474 B

79ms
76ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-aerlhatE2oRJlBRbhX9inWkyqv8anzUcEsM6LRBoNQ--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-aerlhatE2oRJlBRbhX9inWkyqv8anzUcEsM6LRBoNQ--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 188A 42 B
690 B 173ms
79ms Image
image/gif 150.171.28.10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2063625799056981396200&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.28.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "e8cf83ed75a9db1:0"
x-msedge-ref: Ref A: 0BB03D1423C942E3ABB8C26AB9A073BC Ref B: YMQ31EDGE0111 Ref C: 2025-04-24T07:49:01Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 24 Apr 2025 07:49:00 GMT
content-type: image/gif
last-modified: Wed, 09 Apr 2025 17:36:29 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 188A
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=10a08385c1ac1162&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHEep5l-jsngJ3XphRAQEBAQEBAQCXZ8SAdwEBAQEBAQEB&expiration=1745567341&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

51ms
51ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHEep5l-jsngJ3XphRAQEBAQEBAQCXZ8SAdwEBAQEBAQEB&expiration=1745567341&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHEep5l-jsngJ3XphRAQEBAQEBAQCXZ8SAdwEBAQEBAQEB&expiration=1745567341&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 188A
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-9540501e-561b-52d9-625f-06d5f8151d40$ip$139.28.218.139&dongle=4430

37 B
474 B

93ms
69ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-9540501e-561b-52d9-625f-06d5f8151d40$ip$139.28.218.139&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-9540501e-561b-52d9-625f-06d5f8151d40$ip$139.28.218.139&dongle=4430
Content-Length: 140
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

POST v3
id5-sync.com/gm/ 0
0

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 8B14 44 KB
11 KB 33ms
31ms Script
text/html 23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: b78af5b3a8efce8d4846d89d0b9b559a382b436d8b8d64cfc5bf53fdabc9893b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=51758
content-encoding: gzip
expires: Thu, 24 Apr 2025 22:11:39 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11386
date: Thu, 24 Apr 2025 07:49:01 GMT
last-modified: Wed, 23 Apr 2025 22:11:39 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 1DC9 953 B
1 KB 39ms
33ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3bfbc2e1ea709978196769993e84928a454815820e3faf81c840335130ff83f

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 953
content-type: text/html
date: Thu, 24 Apr 2025 07:49:01 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 139.28.218.139

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 576F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIxqVQ-2JfBNJgBd0zYpHFg&google_cver=1

43 B
136 B

45ms
36ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIxqVQ-2JfBNJgBd0zYpHFg&google_cver=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIxqVQ-2JfBNJgBd0zYpHFg&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 576F 170 B
188 B 49ms
48ms Image
image/png 142.250.65.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Yjk3ODlmZjgtODdiMS0yODY2LWMyOTItZjE5Yzc1ZTkxYjdk

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 576F
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=95174c32-4ec6-76c2-d772-ab25bf0bd51d&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0d6ee0ad-71da-4a47-b470-200f01f07af1&ttd_puid=95174c32-4ec6-76c2-d772-ab25bf0bd51d&gdpr=0&gdpr_consent=

43 B
200 B

37ms
35ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=0d6ee0ad-71da-4a47-b470-200f01f07af1&ttd_puid=95174c32-4ec6-76c2-d772-ab25bf0bd51d&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=0d6ee0ad-71da-4a47-b470-200f01f07af1&ttd_puid=95174c32-4ec6-76c2-d772-ab25bf0bd51d&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 24 Apr 2025 07:49:01 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 576F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/01d02a76-de6a-e48b-e6a5-bdd0405c1854?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-jrzygzdE2p9P35hQak7XtjYkiVOLEBu4S8M-~A

43 B
61 B

36ms
36ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-jrzygzdE2p9P35hQak7XtjYkiVOLEBu4S8M-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-jrzygzdE2p9P35hQak7XtjYkiVOLEBu4S8M-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 576F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAns7QAERs2SjQA_

85 B
170 B

20ms
17ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAns7QAERs2SjQA_
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1745480942.858399,VS0,VE0
age: 362
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/png
x-served-by: cache-yul1970033-YUL
server: Jetty(9.4.35.v20201120)
x-cache-hits: 77

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAns7QAERs2SjQA_
x-timer: S1745480942.746619,VS0,VE16
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
x-served-by: cache-yul1970033-YUL
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 576F
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4292834802220618442&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

36ms
35ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4292834802220618442&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4292834802220618442&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 24 Apr 2025 07:48:54 GMT

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame 599A 4 KB
1 KB 111ms
109ms XHR
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4&linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745480940534&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 576e2be1cba4150607b042ebd89d4138be54846466a9d203774d9925db048235

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4&linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745480940534&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9354006d2f76ac3f-YYZ
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame B6CD 2 KB
1 KB 54ms
53ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&bundle=2NCCgV82QTI3VCUyQjJFSGlBRjYlMkJ3QTQlMkJaUHF5RUxmcTRRTkwlMkZ2SDJYRERoczZKU2VyeHFCRnFmazc0dEtud09CRm45T01MWnlWb0NaOXU3QUZFTDNKN0xoV09aY3VMUnh5c1FFTGozbnEzNHlhbWQlMkJzcjZ0Z0VnZEo0NWFJMmVDUTFuSWo&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

24123174a48cd4813d9f4ace970f4133f887050453cb75511e11184db8353b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1141649
expires: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H/1.1 200 imp
aax-us-east.amazon-adsystem.com/e/dtb/ Frame AD5D 43 B
427 B 54ms
50ms Image
image/gif 52.46.145.180
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-us-east.amazon-adsystem.com/e/dtb/imp?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&pp=mfdb0g&isip=1

Requested by

Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.46.145.180 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: no-store, max-age=0
Content-Encoding: gzip
Connection: keep-alive
x-amz-rid: 3NW21CC4MH66854139FY
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 115BTkNA0nL.js Show response
m.media-amazon.com/images/I/ Frame AD5D 3 KB
1 KB 146ms
77ms Script
application/x-javascript 151.101.193.16
FASTLY

General

Check archive.org

Download Go to

Full URL: https://m.media-amazon.com/images/I/115BTkNA0nL.js
Requested by: Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.16 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: aae5689b59724b491ae8e37d078abd63dfa2e4627c38a0566245082439210db5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-ir-id: 85c20d67-8527-49fb-a4af-d93c7bc678a2
content-encoding: br
age: 230935
expires: Thu, 19 Mar 2043 02:29:41 GMT
server-timing: provider;desc="fy"
x-cache: HIT from fastly, HIT from fastly
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: application/x-javascript
vary: Accept-Encoding
x-nginx-cache-status: HIT
last-modified: Thu, 14 Jul 2022 23:38:07 GMT
x-served-by: cache-iad-kiad7000130-IAD, cache-yul1970054-YUL
cache-control: max-age=630720000,public
timing-allow-origin: https://www.amazon.in, https://www.amazon.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 794

GET
H2 200 AmazonUI-05b7372fc66325cf2ba76a5105035a970618cf07.secure.min._V1_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ Frame AD5D 167 KB
19 KB 121ms
12ms Stylesheet
text/css 151.101.193.16
FASTLY

General

Check archive.org

Download Go to

Full URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-05b7372fc66325cf2ba76a5105035a970618cf07.secure.min._V1_.css
Requested by: Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.16 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e76b92d662f3a63c81537cbd4b185af944944f5126695a338a30d032d3478d3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-ir-id: 9bfa6e9f-e4e3-43c3-b4f5-f98590de8b61
content-encoding: br
age: 2238800
expires: Sun, 13 Sep 2043 18:17:05 GMT
server-timing: provider;desc="fy"
x-cache: HIT from fastly, HIT from fastly
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/css
vary: Accept-Encoding
x-nginx-cache-status: HIT
last-modified: Thu, 13 Feb 2014 02:46:43 GMT
x-served-by: cache-iad-kjyo7100178-IAD, cache-yul1970039-YUL
cache-control: max-age=630720000,public
timing-allow-origin: https://www.amazon.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 19412

GET
H2 200 D16GKapowStatic-b1bbbfd5fb74070ef5211f1865257d8cd506a9d6.secure.min._V1_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ Frame AD5D 79 KB
12 KB 75ms
12ms Stylesheet
text/css 151.101.193.16
FASTLY

General

Check archive.org

Download Go to

Full URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/D16GKapowStatic-b1bbbfd5fb74070ef5211f1865257d8cd506a9d6.secure.min._V1_.css
Requested by: Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.16 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: fbe225ec0a2e25e29dfec24e9856ef113334f4e3bbb7b4e3036f41c1d93e0799

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-ir-id: c9a706c4-e8e4-486e-b7bf-870d83393a54
content-encoding: br
age: 5277940
expires: Sun, 27 Sep 2043 12:26:53 GMT
server-timing: provider;desc="fy"
x-cache: HIT from fastly, HIT from fastly
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/css
vary: Accept-Encoding
x-nginx-cache-status: HIT
last-modified: Tue, 07 Apr 2015 02:46:12 GMT
x-served-by: cache-iad-kjyo7100085-IAD, cache-yul1970039-YUL
cache-control: max-age=630720000,public
timing-allow-origin: https://www.amazon.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12130

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame AD5D 17 KB
8 KB 181ms
48ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0de8bced0526195edc9d1a321a1da9a8d9644f897dd9f9ace0fb42ec1483405c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

content-encoding: gzip
age: 1751
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 08:19:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:19:50 GMT
last-modified: Wed, 16 Apr 2025 14:53:50 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 7404
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK / Show response
ts.amazon-adsystem.com/ Frame AD5D 3 KB
4 KB 792ms
175ms Script
application/javascript 18.164.124.70
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ts.amazon-adsystem.com/?s=%7B%22sourceid%22%3A%22600%22%2C%22expname%22%3A%22UNITAG_DISPLAY_ROLLOUT_5500%22%2C%22expbucket%22%3A%22T%22%2C%22sourcetype%22%3A%22dtb%22%2C%22traffictype%22%3A%22web%22%2C%22mediatype%22%3A%22display%22%7D&p=%7B%22bidRequestId%22%3A%229sgDlkLsiTe3oPyk6JqsfA%22%2C%22srcName%22%3A%22CS%22%2C%22gdprConsent%22%3Atrue%2C%22campaignId%22%3A%22579211905739005201%22%2C%22ep%22%3A%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D%2C%22creativeId%22%3A%22588298352861780384%22%2C%22bidId%22%3A%22V6MAbNDSYsmxl0it.b6Cyw%22%2C%22advertiserId%22%3A%22587186333253426960%22%2C%22clickDestnUrl%22%3A%22https%3A%2F%2Fwww.dell.com%2Fen-ca%22%2C%22gdpr%22%3A0%2C%22tungstenCSMLoggingFrameworkUrl%22%3A%22tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F%22%2C%22tsEndpoint%22%3A%22https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F%22%2C%22adId%22%3A%22590123298235643965%22%2C%22au%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%2524%257BAAX_TYPE%257D%26p%3D%2524%257BAAX_PAYLOAD%257D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ%22%2C%22zone%22%3A%22USEast%22%2C%22is3p%22%3Atrue%2C%22ntdUrl%22%3A%22www.btd-cmh.tq-tungsten.com%2F%22%2C%22pm%22%3A%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D%2C%22isBen%22%3Afalse%2C%22targetElement%22%3A%22window%22%2C%22instrUrl%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%22%7D
Requested by: Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-70.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 69b01054244d7afe19406752e7f485c7ec7af866b71e0bda8661cde1da62374a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-version-id: EVGcoGUi2p3fvpQAHroFjHqn_cCPwzgO
ETag: "0d2b6e0960b67523956b24718e9d089f"
Age: 52306
Connection: keep-alive
Via: 1.1 a4c7006ff62b5b4c16c58f54fdfeb656.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 3247
X-Amz-Cf-Id: xAMHFdURQ1AHLTA7TDghdErRgDUtkvyLKRorOF5lnoBr2d_dXMV03A==
Date: Wed, 23 Apr 2025 17:17:17 GMT
Content-Type: application/javascript
Last-Modified: Tue, 05 Nov 2024 12:06:51 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P7
x-amz-server-side-encryption: AES256

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 53ms
50ms Fetch
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504210101/pubads_impl.js?cb=31091935
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s81-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

POST
H3 204 AGSKWxVt8D4_41p7ZHMActDXi9GZoFho2d4d0PkNMjNrDOOJaP1G-D-rlFayl5At_HZQ0XIb8J0H81sPbLinKFkkDk2yIehBrX5aO0dMT_PEhOOsMmqlvTRP8Lldy1hZLYhHlB2rE7u_zA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 61ms
57ms XHR
text/html 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVt8D4_41p7ZHMActDXi9GZoFho2d4d0PkNMjNrDOOJaP1G-D-rlFayl5At_HZQ0XIb8J0H81sPbLinKFkkDk2yIehBrX5aO0dMT_PEhOOsMmqlvTRP8Lldy1hZLYhHlB2rE7u_zA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-U6qcw-LnzYqe4ZyxS8Q6aQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAvxcLy9ufwAm8CGC5cuMim5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI0M9A_P4AgMAm6UlMQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-U6qcw-LnzYqe4ZyxS8Q6aQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 setuid
prebid.intergient.com/ Frame 1DC9 0
901 B 59ms
58ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=acc9c3fd-f759-452b-bcfe-6b303e501790
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745480941&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=wVP79D%2FAuAHvUQHokMqCsBsuC0rNY%2Fsd847xecQTY1o%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745480941&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=wVP79D%2FAuAHvUQHokMqCsBsuC0rNY%2Fsd847xecQTY1o%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9354006dbebb39f4-YYZ
server: cloudflare

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 1DC9
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=759466302077987610

43 B
61 B

46ms
46ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=759466302077987610
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=759466302077987610
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 338d881d-362f-42bd-9c16-79fe2e1613b3
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 1DC9
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=c0d13354-8381-40a2-880b-2bd68690b4c5
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=c0d13354-8381-40a2-880b-2bd68690b4c5

42 B
60 B

51ms
50ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=c0d13354-8381-40a2-880b-2bd68690b4c5
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=c0d13354-8381-40a2-880b-2bd68690b4c5
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame 1DC9
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=93693fce-15c1-4b45-9d93-33f38c871411
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=93693fce-15c1-4b45-9d93-33f38c871411

95 B
428 B

72ms
71ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=93693fce-15c1-4b45-9d93-33f38c871411

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=93693fce-15c1-4b45-9d93-33f38c871411
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 1DC9
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&gdpr=0&gdpr_consent=

43 B
61 B

37ms
37ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 1DC9
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=272289c1-f149-42b2-8a3d-50b867952af3

43 B
61 B

58ms
57ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=272289c1-f149-42b2-8a3d-50b867952af3
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: da3db068-34bd-42a8-a8bf-e40c67e923e7
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=272289c1-f149-42b2-8a3d-50b867952af3
Content-Length: 112
Date: Thu, 24 Apr 2025 07:49:01 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame 1DC9
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=SkHGDudAz-wxBueSbBLvpw==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

37ms
35ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 66D7 0
920 B 87ms
86ms Script
text/html 68.67.181.248
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.248 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: ba9bcab5-f4f8-4eae-a5d4-7cbbc76a4605
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 129ms
128ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

f3e73771920903362ed788de8938ec53ee014d930af7725624c8da6267272572

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 204 rum Show response
elb.the-ozone-project.com/cdn-cgi/ Frame 599A 0
137 B 92ms
90ms XHR
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://elb.the-ozone-project.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4&linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745480940534&bidder=ozone

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 9354006ddfebac3f-YYZ
access-control-allow-origin: https://elb.the-ozone-project.com
date: Thu, 24 Apr 2025 07:49:01 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H2 200 sync
x.bidswitch.net/ 43 B
92 B 52ms
45ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=criteo&custom_data=5lm6lV9UdGpxS0FQZ3E1enYyRWFvdjY2MUlDeTRiamZtVmhqMlk3WkJUcExMSVVnJTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-vzQWxPX7OYzuO9bdqm1OHfCKrTrxl9XYMahkOQ
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dqWSXq19YJTJGUnVsTjJ0T0JkV2pkN2tNTXV6ck1hbXJYVnNMeFdEcVUyZzV2WkdJUWclM0Q%26u%3d%24UID&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=qWSXq19YJTJGUnVsTjJ0T0JkV2pkN2tNTXV6ck1hbXJYVnNMeFdEcVUyZzV2WkdJUWclM0Q&u=759466302077987610&gdpr=0&gdpr_consent=

0
142 B

198ms
88ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=qWSXq19YJTJGUnVsTjJ0T0JkV2pkN2tNTXV6ck1hbXJYVnNMeFdEcVUyZzV2WkdJUWclM0Q&u=759466302077987610&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 24 Apr 2025 07:49:01 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://ssp-sync.criteo.com/user-sync/match?p=qWSXq19YJTJGUnVsTjJ0T0JkV2pkN2tNTXV6ck1hbXJYVnNMeFdEcVUyZzV2WkdJUWclM0Q&u=759466302077987610&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: cd5decb7-9c3b-41cd-929a-27fa787aa312
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-vzQWxPX7OYzuO9bdqm1OHfCKrTrxl9XYMahkOQ&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
https://ssp-sync.criteo.com/user-sync/match?p=btHCDV9zS2Y3M0JxMXdwQSUyRmg0cjBGY2dQR2x6ckFicmNyNmVvSnJuZ0lwc2hPQnclM0Q&u=CAESEOxnTXG7hKcorbZOsoBdbIw&gdpr=0&gdpr_consent=&google_cver=1

0
141 B

200ms
89ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=btHCDV9zS2Y3M0JxMXdwQSUyRmg0cjBGY2dQR2x6ckFicmNyNmVvSnJuZ0lwc2hPQnclM0Q&u=CAESEOxnTXG7hKcorbZOsoBdbIw&gdpr=0&gdpr_consent=&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 24 Apr 2025 07:49:01 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/match?p=btHCDV9zS2Y3M0JxMXdwQSUyRmg0cjBGY2dQR2x6ckFicmNyNmVvSnJuZ0lwc2hPQnclM0Q&u=CAESEOxnTXG7hKcorbZOsoBdbIw&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 395
date: Thu, 24 Apr 2025 07:49:01 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=4292834802220618442

0
144 B

209ms
90ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=4292834802220618442

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=4292834802220618442
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 24 Apr 2025 07:48:53 GMT

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cs.admanmedia.com/e805be652c9053b8f771665f0ac3c361.gif?puid=k-vzQWxPX7OYzuO9bdqm1OHfCKrTrxl9XYMahkOQ&gdpr=0&gdpr_consent=&ccpa=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=[GDPR_CONSENT]&gdpr=0&dsp=507&buyer_id=505c3b46-1a43-4e23-9eda-634ed35826df

0
144 B

32ms
32ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=[GDPR_CONSENT]&gdpr=0&dsp=507&buyer_id=505c3b46-1a43-4e23-9eda-634ed35826df

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Thu, 24 Apr 2025 07:49:07 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=[GDPR_CONSENT]&gdpr=0&dsp=507&buyer_id=505c3b46-1a43-4e23-9eda-634ed35826df
Pragma: no-cache
Connection: keep-alive
Expires: 0
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:08 GMT
Server: nginx

GET
H2 200 sync
x.bidswitch.net/ Frame 599A 43 B
183 B 255ms
147ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=ozone&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 24 Apr 2025 07:49:01 GMT
content-type: image/gif

POST 483.json
id5-sync.com/g/v2/ 0
0

GET
H2 200 impl_v105.js Show response
www.googletagservices.com/dcm/ Frame AD5D 68 KB
26 KB 36ms
32ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v105.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb6988f24a0e19064f2ac7189c4f31560dbe71def169241a739a812d9f72f50a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

content-encoding: gzip
age: 27547
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 00:09:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 00:09:54 GMT
last-modified: Mon, 10 Mar 2025 13:27:01 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 26462
x-xss-protection: 0
server: sffe

GET
H3 200 B33379116.417187950;dc_ver=105.311;sz=160x600;u_sd=1;gdpr=0;nel=1;dvs1=https%3A%2F%2Fpaint.toys%2Foil%2F;dvs10=114;dvs11=%7B%25appId%7D;dvs12=588298352861780384;dvs13=0;dvs2=587186333253426960;dvs3... Show response
ad.doubleclick.net/ddm/adj/N1153793.3142173AAPPROGRAMMATIC/ Frame AD5D 97 KB
37 KB 122ms
80ms Script
text/javascript 142.251.40.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1153793.3142173AAPPROGRAMMATIC/B33379116.417187950;dc_ver=105.311;sz=160x600;u_sd=1;gdpr=0;nel=1;dvs1=https%3A%2F%2Fpaint.toys%2Foil%2F;dvs10=114;dvs11=%7B%25appId%7D;dvs12=588298352861780384;dvs13=0;dvs2=587186333253426960;dvs3=579211905739005201;dvs4=9sgDlkLsiTe3oPyk6JqsfA;dvs5=587186333253426960;dvs6=1;dvs7=590123298235643965;dvs8=160;dvs9=600;lineid=590123298235643965;dc_adk=460273937;ord=k8qhqf;click=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fc%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2Fclv1_CEuOPUxokZAaj3rVC_wi7ybTZGt6brdus68W9mKo7vh74X86jgqGc_w18nFItlOsjqk9wNJBnG7TfU1dCmcAORZGHiu3OvHCCEQdYhlwVx2rQq1tokeO8YkGXCRCW-W6XJfef1DysckRAQc5mlf-bUNLKw8NCIR8DF8hUaU0SRaOiPeNjBAhRVSjPJvkKrciB3IXcovH3a4GaWVHL_JHSt4Bqc6yq8ZkJDb3FIUDhV89loJ0lpuiQ2Mn2W7g_gFPAFPsP9PwnBNBhU0rANRXZBGKekuSlybvN-aHyZjBdrNxAX2f9_6kyU6tSzXsNq2en_cgwOFJcev4qYroMduvO_h7zussfDk4gqII6OtXE5dhyXdTARSC1zmKwaNcU2aAF0BesHvSo10chQXPNe63YFl5fa_FhttaWcM1BB49lTBZW8BvgVxiIF9M2r5De3gQfpa4UOnDkM3gYTE5FjuklpMldW61s2SXOw5AVIUkvN-lEixA7LC22h_5QE1lKbusjtd2_lx7OrAmsSafj3-RzjbvRyRtc2AsGRjCX27Oe-yofB-MEnoq0zp9wY0E38xGoAVeyAriibdEJX2lyLP-1eEy1bz6e002KynVD1Ebc7pqfuCrvd4TfhKltkLZNOvnWCVnEoh4LBEUtelDKJ1RvTwcjO79NQVkWWAftfE424ENY0UvaCb7zyoBujTSGfhAlAspz0QvnoJM0sUQCX2oDE8GuJL0CsOl4J7tLlYUXC3vqlfLXdF8Glc2ILZTOKC5jYJ9PCPi_27L-T3DCAuw4kcMxH8ZZwgOzvlYXccnSxi_1QVGDBJZ4d2pIAZ7S-xtBuw%2F;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fpaint.toys$2,https%3A%2F%2Fpaint.toys%2F$0;xdt=1;crlt=gaDIsP.2lo;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=65;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v105.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb744fe79418bec20e9939f892d8520c74c66e0e51101ec5a3170f2141a7b8b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37470
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 PrebidServer
crb.kargo.com/api/v1/dsync/ Frame 599A 43 B
369 B 174ms
88ms Image
image/gif 100.24.167.139
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/PrebidServer?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dkargo%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.167.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-24-167-139.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 43
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: image/gif
vary: Origin
x-accel-expires: 0

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame DC6E 3 KB
4 KB 151ms
63ms Document
text/html 54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 3bbec908f484f7bc6845eaed7e19b796711a679b707e4603e1bc8807510cd257

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-type: text/html
date: Thu, 24 Apr 2025 07:49:02 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 advbm.js Show response
c.amazon-adsystem.com/vfw/dv/ Frame AD5D 453 KB
100 KB 118ms
44ms Script
text/javascript 3.171.136.233
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/vfw/dv/advbm.js
Requested by: Host: qwxz.themccuskers.com
URL: https://qwxz.themccuskers.com/cnhcpbojwukkfefykyROVdWZ3F1VDl6SWxWWDZnZUQxZWotMjY4Ny0yNjcyMDg3OS0xMDMyMDI4MS0zODMxLWhhR3RYUXBkZDVndmRoWVpBZ1V4/nara6c7b27adouf5v48o6nf03iaxarviovoy9ensx8ro/8nj4vdsmym02uv11vygwo9myg/yxyvdhjlxmdnx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.136.233 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-136-233.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9bde3c78f1c12ce73981456f504a1443c2ebd6fbee3a994d348c9e1c403b56f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

vary: accept-encoding
content-encoding: br
etag: W/"dcfea4344226c71ea9bc85f40a3a716d"
x-amz-version-id: 6ecnFcQRRCUDJYaOJbUmM9rOdMmCaHGO
age: 5456
via: 1.1 ded721d3aeecfb4f35d39da9e2d34066.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: hsJkXkx5zEHQ3nKVsk8JOkPxwZO4unTJeMz41kHei24aAM6LJ7_Tnw==
date: Thu, 24 Apr 2025 06:18:07 GMT
content-type: text/javascript
last-modified: Wed, 26 Mar 2025 12:55:52 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P8
x-amz-server-side-encryption: AES256

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame AD5D 117 KB
41 KB 252ms
49ms Script
text/javascript 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://aax-us-east.amazon-adsystem.com
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

content-encoding: gzip
age: 77441
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 10:18:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Apr 2025 10:18:21 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250423/r20110914/elements/html/ Frame AD5D 12 KB
4 KB 75ms
33ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250423/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1153793.3142173AAPPROGRAMMATIC/B33379116.417187950;dc_ver=105.311;sz=160x600;u_sd=1;gdpr=0;nel=1;dvs1=https%3A%2F%2Fpaint.toys%2Foil%2F;dvs10=114;dvs11=%7B%25appId%7D;dvs12=588298352861780384;dvs13=0;dvs2=587186333253426960;dvs3=579211905739005201;dvs4=9sgDlkLsiTe3oPyk6JqsfA;dvs5=587186333253426960;dvs6=1;dvs7=590123298235643965;dvs8=160;dvs9=600;lineid=590123298235643965;dc_adk=460273937;ord=k8qhqf;click=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fc%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2Fclv1_CEuOPUxokZAaj3rVC_wi7ybTZGt6brdus68W9mKo7vh74X86jgqGc_w18nFItlOsjqk9wNJBnG7TfU1dCmcAORZGHiu3OvHCCEQdYhlwVx2rQq1tokeO8YkGXCRCW-W6XJfef1DysckRAQc5mlf-bUNLKw8NCIR8DF8hUaU0SRaOiPeNjBAhRVSjPJvkKrciB3IXcovH3a4GaWVHL_JHSt4Bqc6yq8ZkJDb3FIUDhV89loJ0lpuiQ2Mn2W7g_gFPAFPsP9PwnBNBhU0rANRXZBGKekuSlybvN-aHyZjBdrNxAX2f9_6kyU6tSzXsNq2en_cgwOFJcev4qYroMduvO_h7zussfDk4gqII6OtXE5dhyXdTARSC1zmKwaNcU2aAF0BesHvSo10chQXPNe63YFl5fa_FhttaWcM1BB49lTBZW8BvgVxiIF9M2r5De3gQfpa4UOnDkM3gYTE5FjuklpMldW61s2SXOw5AVIUkvN-lEixA7LC22h_5QE1lKbusjtd2_lx7OrAmsSafj3-RzjbvRyRtc2AsGRjCX27Oe-yofB-MEnoq0zp9wY0E38xGoAVeyAriibdEJX2lyLP-1eEy1bz6e002KynVD1Ebc7pqfuCrvd4TfhKltkLZNOvnWCVnEoh4LBEUtelDKJ1RvTwcjO79NQVkWWAftfE424ENY0UvaCb7zyoBujTSGfhAlAspz0QvnoJM0sUQCX2oDE8GuJL0CsOl4J7tLlYUXC3vqlfLXdF8Glc2ILZTOKC5jYJ9PCPi_27L-T3DCAuw4kcMxH8ZZwgOzvlYXccnSxi_1QVGDBJZ4d2pIAZ7S-xtBuw%2F;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fpaint.toys$2,https%3A%2F%2Fpaint.toys%2F$0;xdt=1;crlt=gaDIsP.2lo;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=65;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ec0d4a8b73c1b311d91ec21907b35ed43be697059740b70571f5a8abe40a96a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

content-encoding: br
etag: 8593911155552589720
age: 63347
x-content-type-options: nosniff
expires: Wed, 07 May 2025 14:13:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 23 Apr 2025 14:13:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 4395
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame AD5D 41 KB
14 KB 240ms
50ms Script
text/javascript 142.250.72.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.97 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

content-encoding: br
age: 2839
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 07:51:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:01:43 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 ac-topright-sprite.png
images-na.ssl-images-amazon.com/images/G/15/da/adchoices/ Frame AD5D 2 KB
2 KB 36ms
34ms Image
image/png 151.101.193.16
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://images-na.ssl-images-amazon.com/images/G/15/da/adchoices/ac-topright-sprite.png
Requested by: Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7&rnd=3319145204881745480941219&pp=mfdb0g&p=ioiscg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.16 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ef41212a278b695b42d60b2ab9423983c102297349d13439c5e13abeb3c2aa01

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-ir-id: d0049c10-52bc-476f-bd17-f761a19fe8d6
age: 72590
expires: Sat, 17 Feb 2024 03:11:17 GMT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT from fastly, HIT from fastly
server-timing: provider;desc="fy"
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: image/png
last-modified: Fri, 16 Nov 2012 23:02:38 GMT
x-nginx-cache-status: HIT
x-served-by: cache-iad-kiad7000129-IAD, cache-yul1970039-YUL
cache-control: max-age=86400,public
timing-allow-origin: https://www.amazon.ca
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1711

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 599A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=u40cpuw&ttd_tpi=1&gdpr=0&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=0d6ee0ad-71da-4a47-b470-200f01f07af1

0
301 B

69ms
69ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=0d6ee0ad-71da-4a47-b470-200f01f07af1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93540070f981ac3f-YYZ
expires: 0
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

location: https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=0d6ee0ad-71da-4a47-b470-200f01f07af1
content-length: 215
date: Thu, 24 Apr 2025 07:49:02 GMT
server: Kestrel

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 8B14 7 B
1 KB 242ms
49ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 sts.js Show response
vfw.amazon-adsystem.com/dv/proxy/ Frame AD5D 741 B
671 B 477ms
90ms Script
text/javascript 3.220.253.138
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://vfw.amazon-adsystem.com/dv/proxy/sts.js?gdpr_consent=&flvr=4&ttmms=25&ttfrms=32&brid=96&bridua=3&bds=1&tstype=128&prndr=1&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTau22I%5CFD%5C62DE%5D2%3E2K%40%3F%5C25DJDE6%3E%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTau%40%3A%3DTau&srcurlD=1&aUrlD=-1&ssl=https:&dfs=716&ddur=164&uid=1745480942347215&jsCallback=dvCallback_1745480942347995&dvtagver=6.1.src&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7529&tgjsver=7529&lvvn=28&m1=96&refD=2&referrer=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fe%2Fdtb%2Fadmi%3Fb%3DJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%26rnd%3D3319145204881745480941219%26pp%3Dmfdb0g%26p%3Dioiscg&fcifrms=25&brh=2&dvp_epl=254&noc=16&nav_pltfrm=Linux%20x86_64&ctx=3886119&cmp=33379116&sid=5726991&plc=417187950&crt=232340778&adsrv=1&advid=9683519&unit=160x600&turl=https%3A%2F%2Fpaint.toys%2Foil%2F&c1=590123298235643965&c2=160&c3=600&gdpr=0&errorURL=https://vfw.amazon-adsystem.com/dv/proxy/sts.png&ppid=114&auevent=9sgDlkLsiTe3oPyk6JqsfA&auadv=587186333253426960&aucmp=579211905739005201&aucrtv=588298352861780384&aufilter1=587186333253426960&autt=1&aubndl=%7B%25appId%7D&mib=0&mon=1&blk=0&dvp_cawf=crtwrp&cm360cw=1&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=2551734339.9920754&ee_dp_sukv=2551734339.9920754&dvp_tukv=1519527726.6221821&ee_dp_tukv=1519527726.6221821&dvp_strhd=0.6000022888183594&dvpx_strhd=0.6000022888183594&dvp_tuid=1349375435219&jurtd=3924218592
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/vfw/dv/advbm.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.253.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-253-138.compute-1.amazonaws.com
Software: Server /
Resource Hash: 62e7f90e3873c401e22186869fd56a0a38214d52fbd6e680e60c24542920dd7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amzn-requestid: bc731941-c253-4f15-b2df-297a13882da2
content-length: 512
content-encoding: br
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: text/javascript
vary: Accept-Encoding
server: Server

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://bh.contextweb.com/bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=UaeKXLbJ7XtU&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0

0
354 B

40ms
39ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=UaeKXLbJ7XtU&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=UaeKXLbJ7XtU&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-cc58c7bc8-tgpcm
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
server: Jetty(12.0.17)

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://ads.stickyadstv.com/user-matching?gdpr=0&gdpr_consent=&id=3663
https://cs.yellowblue.io/cs?aid=11601&id=dd15a7efa2644ae9eca89c87fb5747e&gdpr_consent=&gdpr=0

0
354 B

86ms
85ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=dd15a7efa2644ae9eca89c87fb5747e&gdpr_consent=&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache
Location: https://cs.yellowblue.io/cs?aid=11601&id=dd15a7efa2644ae9eca89c87fb5747e&gdpr_consent=&gdpr=0
Pragma: no-cache
x-sticky-vk: 1745480942483008-280
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:02 GMT
Server: nginx

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=

0
401 B

111ms
110ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
x-reason: missing buyer cookie sync value, buyer id: '11603'
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:02 GMT

GET
H2

200

sync
x.bidswitch.net/ Frame DC6E
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?gdpr=0&gdpr_consent=&profile=342&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11614%26id%3D%24%7BCRITEO_USER_ID%7D
https://x.bidswitch.net/sync?ssp=criteo&custom_data=3n3uu193TUhDJTJCOVA0cms3RjFyMncyTWVPWTk5VzZtMDg3YktDaWlOVkklMkJWYzMyRDhFcXBtTnF2aUY2T29yQ0NtTUdrb2Z4Y25HU2FKYkNCUlBsMEdXSUhpTmlUbExKblhUWiUyQjJkN...

43 B
92 B

73ms
72ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=criteo&custom_data=3n3uu193TUhDJTJCOVA0cms3RjFyMncyTWVPWTk5VzZtMDg3YktDaWlOVkklMkJWYzMyRDhFcXBtTnF2aUY2T29yQ0NtTUdrb2Z4Y25HU2FKYkNCUlBsMEdXSUhpTmlUbExKblhUWiUyQjJkNmRLM3VWZ1ZQWW5hSXdJV3J0WEJBbHFYT09aaXJrb0R1YWY1ckN3d2tjV1ZyMHZraTZCJTJGJTJGT1k0VG8zM3JiV2JDaUVGT1BGQVBrJTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-vzQWxPX7OYzuO9bdqm1OHfCKrTrxl9XYMahkOQ
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
location: https://x.bidswitch.net/sync?ssp=criteo&custom_data=3n3uu193TUhDJTJCOVA0cms3RjFyMncyTWVPWTk5VzZtMDg3YktDaWlOVkklMkJWYzMyRDhFcXBtTnF2aUY2T29yQ0NtTUdrb2Z4Y25HU2FKYkNCUlBsMEdXSUhpTmlUbExKblhUWiUyQjJkNmRLM3VWZ1ZQWW5hSXdJV3J0WEJBbHFYT09aaXJrb0R1YWY1ckN3d2tjV1ZyMHZraTZCJTJGJTJGT1k0VG8zM3JiV2JDaUVGT1BGQVBrJTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-vzQWxPX7OYzuO9bdqm1OHfCKrTrxl9XYMahkOQ
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://sync.inmobi.com/oRTB?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-5-a277a5a1-8c73-42bb-9273-b8830a8d1b2e

0
354 B

51ms
38ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-5-a277a5a1-8c73-42bb-9273-b8830a8d1b2e
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 4
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-5-a277a5a1-8c73-42bb-9273-b8830a8d1b2e
content-length: 0
date: Thu, 24 Apr 2025 07:49:01 GMT
x-envoy-upstream-service-time: 0
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://sync.go.sonobi.com/us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=2ff6addd-7aa6-4ee0-8172-f0f6d95ba744

0
354 B

98ms
87ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=2ff6addd-7aa6-4ee0-8172-f0f6d95ba744
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-cache, no-store, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=2ff6addd-7aa6-4ee0-8172-f0f6d95ba744
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 24 Apr 2025 07:49:02 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-89
x-xss-protection: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=759466302077987610

0
354 B

76ms
57ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=759466302077987610
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=759466302077987610
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 1e96bfac-fe37-49b4-9ba1-d85e2281b580
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://us-u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=58ceaaf5-c766-4c17-869a-d76e43401714&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26id%3D
https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=7d1750a4-9929-4b87-9c35-f7b79ea2015e

0
354 B

43ms
37ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=7d1750a4-9929-4b87-9c35-f7b79ea2015e
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=7d1750a4-9929-4b87-9c35-f7b79ea2015e
pragma: no-cache
x-forwarded-for: 139.28.218.139
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://contextual.media.net/cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3C...
https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3884825422397923000V10

0
354 B

32ms
31ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3884825422397923000V10
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3884825422397923000V10
timing-allow-origin: *
pragma: no-cache
expires: Thu, 24 Apr 2025 07:49:02 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
content-length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: text/html
server: Apache

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings
https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings&zcc=1&cb=1745480942547
https://ad.turn.com/r/cs?pid=45&id=RX-aa818eaa-2c2e-4c81-82c1-119baa1283d0-005&rndcb=899328822
https://sync.1rx.io/usersync/turn/4292834802220618442?dspret=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-aa818eaa-2c2e-4c81-82c1-119baa1283d0-005?redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11599%26id%3DRX-aa818eaa-2c2e-4c81-82c1-119baa1283d0-005
https://cs.yellowblue.io/cs?aid=11599&id=RX-aa818eaa-2c2e-4c81-82c1-119baa1283d0-005

0
354 B

33ms
31ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11599&id=RX-aa818eaa-2c2e-4c81-82c1-119baa1283d0-005
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11599&id=RX-aa818eaa-2c2e-4c81-82c1-119baa1283d0-005
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 24 Apr 2025 07:49:03 GMT
etag: RXaa818eaa2c2e4c8182c1119baa1283d0005
content-type: text/html

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://match.sharethrough.com/universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422
https://cs.yellowblue.io/cs?aid=11587&uid=ecdc54d4-e8e3-4170-9a86-05144c84ef0f&gdpr=0

0
354 B

70ms
70ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=ecdc54d4-e8e3-4170-9a86-05144c84ef0f&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cs.yellowblue.io/cs?aid=11587&uid=ecdc54d4-e8e3-4170-9a86-05144c84ef0f&gdpr=0
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=rise&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11574%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=44d069d6f9

0
354 B

71ms
71ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=44d069d6f9
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=44d069d6f9
content-length: 5
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: text/plain; charset=utf-8

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://csync.loopme.me/?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D
https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=0f8c7231-6729-46a0-adb3-b91d64667bab&gdpr_consent=null&gdpr=0

0
354 B

53ms
51ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=0f8c7231-6729-46a0-adb3-b91d64667bab&gdpr_consent=null&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=0f8c7231-6729-46a0-adb3-b91d64667bab&gdpr_consent=null&gdpr=0
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
server: _

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://creativecdn.com/cm-notify?pi=rise
https://creativecdn.com/cm-notify?pi=rise&tc=1
https://cs.yellowblue.io/cs?aid=11610&id=CBEU9ZxlH4ov2nWna2rmQpON9yES8CWQl8WTJz1JnVY&pi=rise&tc=1

0
354 B

36ms
31ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11610&id=CBEU9ZxlH4ov2nWna2rmQpON9yES8CWQl8WTJz1JnVY&pi=rise&tc=1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://cs.yellowblue.io/cs?aid=11610&id=CBEU9ZxlH4ov2nWna2rmQpON9yES8CWQl8WTJz1JnVY&pi=rise&tc=1
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT, Thu, 24 Apr 2025 07:49:03 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame DC6E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_966993b1-20e0-11f0-846c-123a7eade4d1&gdpr=0
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E

0
354 B

34ms
33ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 115
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: text/html; charset=utf-8

GET
H3 200 setuid
prebid.intergient.com/ Frame DC6E 0
978 B 59ms
54ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rise&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=iNcNYK29C
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745480942&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=QH8rRwr%2Bbs%2FAUPibdNknK%2FsygERPkz4gsUdAI5Uwb0c%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745480942&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=QH8rRwr%2Bbs%2FAUPibdNknK%2FsygERPkz4gsUdAI5Uwb0c%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93540072295539f4-YYZ
server: cloudflare

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 599A
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?us_privacy=pbs-ozone&gdpr=0&gdpr_consent=&s=189937&cb=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D0%26gdpr_consent%3D%26us_pr...
https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAns7NHM6ucAACBYAJvLxgAA%263869

0
378 B

82ms
77ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAns7NHM6ucAACBYAJvLxgAA%263869
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 935400738ad8ac3f-YYZ
expires: 0
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAns7NHM6ucAACBYAJvLxgAA%263869
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5z7l%2F6HgP5LOVfrU0%2F6MHfpON6x4fMl8ke6WE5Jlj9%2FeMU1I9VNpcFCVPs3IxlFRC0l5dEDMVuozTguplNBD%2B3OKB1CWGq0GUH%2FgAQ2L9NA88Tve7OVGm%2BRgE%2BxbIFcG83AOPRf3"}],"group":"cf-nel","max_age":604800}
cf-ray: 93540072dedbaace-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 24 Apr 2025 07:49:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame C9E7
Redirect Chain

https://ssp.disqus.com/redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716
https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119

0
354 B

59ms
58ms

Document
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 24 Apr 2025 07:49:02 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store
content-length: 0
expires: 0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
pragma: no-cache

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame DC5E
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KjHVALZHrLFLy8LnTNa0WcPA

0
354 B

80ms
80ms

Document
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KjHVALZHrLFLy8LnTNa0WcPA
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 24 Apr 2025 07:49:02 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KjHVALZHrLFLy8LnTNa0WcPA
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 3E14 2 KB
1003 B 98ms
35ms Document
text/html 51.222.39.185
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113

Requested by

Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.185 , Canada, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ip185.ip-51-222-39.net

Software

Resource Hash

d6b9ac8ccff69f2de32254b96a2bb180535f809c2d8059d40be5844a8cbad026

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 870
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame B78F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage
https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

269 B
379 B

40ms
28ms

Document
text/html

23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 24 Apr 2025 07:49:02 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
location: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
server: AkamaiGHost

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame BA07 38 KB
13 KB 36ms
36ms Document
text/html 142.250.72.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.97 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://aax-us-east.amazon-adsystem.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2838
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Apr 2025 07:01:44 GMT
expires: Thu, 24 Apr 2025 07:51:44 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame AD5D 220 KB
68 KB 33ms
32ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a798986e0dce849145906cae97bf77a273b5ffb8880fc0f7da14eff4a9b85aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

content-encoding: br
etag: 4151480097505160345
age: 2117
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 08:13:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 24 Apr 2025 07:13:45 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-7
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69290
x-xss-protection: 0
server: cafe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html Show response
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 9 KB
3 KB 90ms
34ms Document
text/html 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

903de09947b93e60f48a6a8e4eb151e87221d3d8e0c21435ec48cebd504ed341

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://aax-us-east.amazon-adsystem.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 11939
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2705
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 24 Apr 2025 04:30:03 GMT
expires: Fri, 24 Apr 2026 04:30:03 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame AD5D 0
0 65ms
64ms Fetch
image/png 142.251.40.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssNLLyJCwds29uiG3y-d5k-TnSeMlL95GdiAoy1byh2Asm31v6CeeRvweC6wmRt_tRLmfVNy46YV5zOT4RmKNxDOa3DvkRPXoGG3G0o6u9kowCsKKDvKoXZO0bzICCwrQLsnoy16Su3VI80TK7DolBURupDXYhrKHzXdTeDUv48-HJcCPumDaT5J_ht-3uLgwgIc6BzcoI00ut6IxpFEaPXRS6UmA&sai=AMfl-YRphAkNxKaOb5dqQkX2JvmymNyf6h-bX1Fl90tX4NKiLgf6bHy52YL-bJ4Rq9Mu0KTRJgJyrZorhRZEDICBrC1Ed-uuQXiyeFw&sig=Cg0ArKJSzCfKrEEh9-boEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9kZWxsLmNvbQ&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=309&cbvp=1&cstd=306&cisv=r20250423.09944&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 07:49:02 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"909077132":"0x355969b7d9a412810000000000000000","909077133":"0x413c40176642df980000000000000000","909077134":"0x298d4e78226f79430000000000000000","909077135":"0xf494cbe0b4681af40000000000000000"},"debug_key":"16083388326483006192","debug_reporting":true,"destination":["https://dell.com","https://alienwarearena.com","https://delltechnologies.com"],"event_report_windows":{"end_times":[86400,604800,2592000]},"expiry":"2592000","filter_data":{"14":[],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["9632645"]},"max_event_level_reports":2,"priority":"0","source_event_id":"5633309209715746513"}
server: cafe

GET
H3 200 EkdjyKrF1NmAsk7REIAGOde1tWhmsx7zcO2hk2jj3tw.js Show response
pagead2.googlesyndication.com/bg/ Frame BA07 54 KB
21 KB 39ms
36ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EkdjyKrF1NmAsk7REIAGOde1tWhmsx7zcO2hk2jj3tw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

124763c8aac5d4d980b24ed110800639d7b5b56866b31ef370eda19368e3dedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 28955
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 23 Apr 2026 23:46:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Apr 2025 23:46:27 GMT
last-modified: Mon, 07 Apr 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21240
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK csm_view_onlytpmv1.js Show response
ts.amazon-adsystem.com/tg/resources/vue/web-display/aes/ Frame AD5D 47 KB
47 KB 219ms
216ms Script
application/javascript 18.164.124.70
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ts.amazon-adsystem.com/tg/resources/vue/web-display/aes/csm_view_onlytpmv1.js?bidRequestId=9sgDlkLsiTe3oPyk6JqsfA&srcName=CS&gdprConsent=true&campaignId=579211905739005201&ep=%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D&creativeId=588298352861780384&bidId=V6MAbNDSYsmxl0it.b6Cyw&advertiserId=587186333253426960&clickDestnUrl=https%3A%2F%2Fwww.dell.com%2Fen-ca&gdpr=0&tungstenCSMLoggingFrameworkUrl=tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F&tsEndpoint=https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F&adId=590123298235643965&au=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%24%7BAAX_TYPE%7D%26p%3D%24%7BAAX_PAYLOAD%7D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ&zone=USEast&is3p=true&ntdUrl=www.btd-cmh.tq-tungsten.com%2F&pm=%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D&isBen=false&targetElement=window&instrUrl=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F&sourceid=600&expname=UNITAG_DISPLAY_ROLLOUT_5500&expbucket=T&sourcetype=dtb&traffictype=web&mediatype=display
Requested by: Host: ts.amazon-adsystem.com
URL: https://ts.amazon-adsystem.com/?s=%7B%22sourceid%22%3A%22600%22%2C%22expname%22%3A%22UNITAG_DISPLAY_ROLLOUT_5500%22%2C%22expbucket%22%3A%22T%22%2C%22sourcetype%22%3A%22dtb%22%2C%22traffictype%22%3A%22web%22%2C%22mediatype%22%3A%22display%22%7D&p=%7B%22bidRequestId%22%3A%229sgDlkLsiTe3oPyk6JqsfA%22%2C%22srcName%22%3A%22CS%22%2C%22gdprConsent%22%3Atrue%2C%22campaignId%22%3A%22579211905739005201%22%2C%22ep%22%3A%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D%2C%22creativeId%22%3A%22588298352861780384%22%2C%22bidId%22%3A%22V6MAbNDSYsmxl0it.b6Cyw%22%2C%22advertiserId%22%3A%22587186333253426960%22%2C%22clickDestnUrl%22%3A%22https%3A%2F%2Fwww.dell.com%2Fen-ca%22%2C%22gdpr%22%3A0%2C%22tungstenCSMLoggingFrameworkUrl%22%3A%22tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F%22%2C%22tsEndpoint%22%3A%22https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F%22%2C%22adId%22%3A%22590123298235643965%22%2C%22au%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%2524%257BAAX_TYPE%257D%26p%3D%2524%257BAAX_PAYLOAD%257D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ%22%2C%22zone%22%3A%22USEast%22%2C%22is3p%22%3Atrue%2C%22ntdUrl%22%3A%22www.btd-cmh.tq-tungsten.com%2F%22%2C%22pm%22%3A%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D%2C%22isBen%22%3Afalse%2C%22targetElement%22%3A%22window%22%2C%22instrUrl%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%22%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-70.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c03d99c9407c075f452c83f31aee45389e4e40aed75c4c0fb054ab3a207ebbe9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-version-id: IDa9lef0A3iIYtpfZzYlyMxzq1Q_aNlC
ETag: "e1b283ecd774735e8c12015c77cd5bfa"
Age: 52306
Connection: keep-alive
Via: 1.1 a4c7006ff62b5b4c16c58f54fdfeb656.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 47841
X-Amz-Cf-Id: 2Cc3H78iuR0US2ZR__dgfuPUr8ykTzJu0xLGQLrDQF251iEUONwP5w==
Date: Wed, 23 Apr 2025 17:17:17 GMT
Content-Type: application/javascript
Last-Modified: Mon, 28 Oct 2024 06:55:36 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P7
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK adforensics_basic.js Show response
ts.amazon-adsystem.com/tg/resources/tq-forensics/ Frame AD5D 14 KB
14 KB 515ms
220ms Script
application/javascript 18.164.124.70
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ts.amazon-adsystem.com/tg/resources/tq-forensics/adforensics_basic.js?bidRequestId=9sgDlkLsiTe3oPyk6JqsfA&srcName=CS&gdprConsent=true&campaignId=579211905739005201&ep=%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D&creativeId=588298352861780384&bidId=V6MAbNDSYsmxl0it.b6Cyw&advertiserId=587186333253426960&clickDestnUrl=https%3A%2F%2Fwww.dell.com%2Fen-ca&gdpr=0&tungstenCSMLoggingFrameworkUrl=tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F&tsEndpoint=https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F&adId=590123298235643965&au=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%24%7BAAX_TYPE%7D%26p%3D%24%7BAAX_PAYLOAD%7D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ&zone=USEast&is3p=true&ntdUrl=www.btd-cmh.tq-tungsten.com%2F&pm=%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D&isBen=false&targetElement=window&instrUrl=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F&sourceid=600&expname=UNITAG_DISPLAY_ROLLOUT_5500&expbucket=T&sourcetype=dtb&traffictype=web&mediatype=display
Requested by: Host: ts.amazon-adsystem.com
URL: https://ts.amazon-adsystem.com/?s=%7B%22sourceid%22%3A%22600%22%2C%22expname%22%3A%22UNITAG_DISPLAY_ROLLOUT_5500%22%2C%22expbucket%22%3A%22T%22%2C%22sourcetype%22%3A%22dtb%22%2C%22traffictype%22%3A%22web%22%2C%22mediatype%22%3A%22display%22%7D&p=%7B%22bidRequestId%22%3A%229sgDlkLsiTe3oPyk6JqsfA%22%2C%22srcName%22%3A%22CS%22%2C%22gdprConsent%22%3Atrue%2C%22campaignId%22%3A%22579211905739005201%22%2C%22ep%22%3A%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D%2C%22creativeId%22%3A%22588298352861780384%22%2C%22bidId%22%3A%22V6MAbNDSYsmxl0it.b6Cyw%22%2C%22advertiserId%22%3A%22587186333253426960%22%2C%22clickDestnUrl%22%3A%22https%3A%2F%2Fwww.dell.com%2Fen-ca%22%2C%22gdpr%22%3A0%2C%22tungstenCSMLoggingFrameworkUrl%22%3A%22tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F%22%2C%22tsEndpoint%22%3A%22https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F%22%2C%22adId%22%3A%22590123298235643965%22%2C%22au%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%2524%257BAAX_TYPE%257D%26p%3D%2524%257BAAX_PAYLOAD%257D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ%22%2C%22zone%22%3A%22USEast%22%2C%22is3p%22%3Atrue%2C%22ntdUrl%22%3A%22www.btd-cmh.tq-tungsten.com%2F%22%2C%22pm%22%3A%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D%2C%22isBen%22%3Afalse%2C%22targetElement%22%3A%22window%22%2C%22instrUrl%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%22%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-70.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cd7dec3d0ff0abcf2c21687ace4eafb4ccff2d32a1a25454fce5f9ff39536675

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-version-id: WlrLvLZYQ68odjRWb.mob5DuLt9NMGJV
ETag: "3211b94fd1c792dd7631646542796249"
Age: 52306
Connection: keep-alive
Via: 1.1 a4c7006ff62b5b4c16c58f54fdfeb656.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 14172
X-Amz-Cf-Id: 6LAOmW6nMMNwP4PXcXfPa2ax3uPYBzWp8loksUWry-KFI8SdbbV5ew==
Date: Wed, 23 Apr 2025 17:17:17 GMT
Content-Type: application/javascript
Last-Modified: Wed, 19 Mar 2025 09:58:07 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P7
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK adforensics_csmcollection.js Show response
ts.amazon-adsystem.com/tg/resources/tq-forensics/pst/ Frame AD5D 48 KB
48 KB 749ms
233ms Script
application/javascript 18.164.124.70
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ts.amazon-adsystem.com/tg/resources/tq-forensics/pst/adforensics_csmcollection.js?bidRequestId=9sgDlkLsiTe3oPyk6JqsfA&srcName=CS&gdprConsent=true&campaignId=579211905739005201&ep=%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D&creativeId=588298352861780384&bidId=V6MAbNDSYsmxl0it.b6Cyw&advertiserId=587186333253426960&clickDestnUrl=https%3A%2F%2Fwww.dell.com%2Fen-ca&gdpr=0&tungstenCSMLoggingFrameworkUrl=tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F&tsEndpoint=https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F&adId=590123298235643965&au=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%24%7BAAX_TYPE%7D%26p%3D%24%7BAAX_PAYLOAD%7D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ&zone=USEast&is3p=true&ntdUrl=www.btd-cmh.tq-tungsten.com%2F&pm=%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D&isBen=false&targetElement=window&instrUrl=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F&sourceid=600&expname=UNITAG_DISPLAY_ROLLOUT_5500&expbucket=T&sourcetype=dtb&traffictype=web&mediatype=display
Requested by: Host: ts.amazon-adsystem.com
URL: https://ts.amazon-adsystem.com/?s=%7B%22sourceid%22%3A%22600%22%2C%22expname%22%3A%22UNITAG_DISPLAY_ROLLOUT_5500%22%2C%22expbucket%22%3A%22T%22%2C%22sourcetype%22%3A%22dtb%22%2C%22traffictype%22%3A%22web%22%2C%22mediatype%22%3A%22display%22%7D&p=%7B%22bidRequestId%22%3A%229sgDlkLsiTe3oPyk6JqsfA%22%2C%22srcName%22%3A%22CS%22%2C%22gdprConsent%22%3Atrue%2C%22campaignId%22%3A%22579211905739005201%22%2C%22ep%22%3A%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D%2C%22creativeId%22%3A%22588298352861780384%22%2C%22bidId%22%3A%22V6MAbNDSYsmxl0it.b6Cyw%22%2C%22advertiserId%22%3A%22587186333253426960%22%2C%22clickDestnUrl%22%3A%22https%3A%2F%2Fwww.dell.com%2Fen-ca%22%2C%22gdpr%22%3A0%2C%22tungstenCSMLoggingFrameworkUrl%22%3A%22tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F%22%2C%22tsEndpoint%22%3A%22https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F%22%2C%22adId%22%3A%22590123298235643965%22%2C%22au%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%2524%257BAAX_TYPE%257D%26p%3D%2524%257BAAX_PAYLOAD%257D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ%22%2C%22zone%22%3A%22USEast%22%2C%22is3p%22%3Atrue%2C%22ntdUrl%22%3A%22www.btd-cmh.tq-tungsten.com%2F%22%2C%22pm%22%3A%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D%2C%22isBen%22%3Afalse%2C%22targetElement%22%3A%22window%22%2C%22instrUrl%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%22%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-70.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4e419f106df79d63a3b69774e6eda1a9a651adf11c41eca7ca10844d92ff90ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-version-id: lvmKVPkKUqsJLfKxNcYUgL_Bzwv8zM7o
ETag: "9b8a67befc038209293e721d69138020"
Age: 52307
Connection: keep-alive
Via: 1.1 d07915e7a5c22513f7a2f462a7421cce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 48867
X-Amz-Cf-Id: kH0tMB985zOA1QuyhYLa1e4yQ5WlUfQIi3nzD6rDHoLITH7ee03CvQ==
Date: Wed, 23 Apr 2025 17:17:17 GMT
Content-Type: application/javascript
Last-Modified: Tue, 05 Nov 2024 12:03:35 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P7
x-amz-server-side-encryption: AES256

GET
H2 200 ara.js Show response
d37unsldgykj8z.cloudfront.net/ Frame AD5D 4 KB
2 KB 180ms
60ms Script
application/javascript 18.173.242.145
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://d37unsldgykj8z.cloudfront.net/ara.js?bidRequestId=9sgDlkLsiTe3oPyk6JqsfA&srcName=CS&gdprConsent=true&campaignId=579211905739005201&ep=%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D&creativeId=588298352861780384&bidId=V6MAbNDSYsmxl0it.b6Cyw&advertiserId=587186333253426960&clickDestnUrl=https%3A%2F%2Fwww.dell.com%2Fen-ca&gdpr=0&tungstenCSMLoggingFrameworkUrl=tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F&tsEndpoint=https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F&adId=590123298235643965&au=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%24%7BAAX_TYPE%7D%26p%3D%24%7BAAX_PAYLOAD%7D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ&zone=USEast&is3p=true&ntdUrl=www.btd-cmh.tq-tungsten.com%2F&pm=%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D&isBen=false&targetElement=window&instrUrl=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F&sourceid=600&expname=UNITAG_DISPLAY_ROLLOUT_5500&expbucket=T&sourcetype=dtb&traffictype=web&mediatype=display
Requested by: Host: ts.amazon-adsystem.com
URL: https://ts.amazon-adsystem.com/?s=%7B%22sourceid%22%3A%22600%22%2C%22expname%22%3A%22UNITAG_DISPLAY_ROLLOUT_5500%22%2C%22expbucket%22%3A%22T%22%2C%22sourcetype%22%3A%22dtb%22%2C%22traffictype%22%3A%22web%22%2C%22mediatype%22%3A%22display%22%7D&p=%7B%22bidRequestId%22%3A%229sgDlkLsiTe3oPyk6JqsfA%22%2C%22srcName%22%3A%22CS%22%2C%22gdprConsent%22%3Atrue%2C%22campaignId%22%3A%22579211905739005201%22%2C%22ep%22%3A%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D%2C%22creativeId%22%3A%22588298352861780384%22%2C%22bidId%22%3A%22V6MAbNDSYsmxl0it.b6Cyw%22%2C%22advertiserId%22%3A%22587186333253426960%22%2C%22clickDestnUrl%22%3A%22https%3A%2F%2Fwww.dell.com%2Fen-ca%22%2C%22gdpr%22%3A0%2C%22tungstenCSMLoggingFrameworkUrl%22%3A%22tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F%22%2C%22tsEndpoint%22%3A%22https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F%22%2C%22adId%22%3A%22590123298235643965%22%2C%22au%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%2524%257BAAX_TYPE%257D%26p%3D%2524%257BAAX_PAYLOAD%257D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ%22%2C%22zone%22%3A%22USEast%22%2C%22is3p%22%3Atrue%2C%22ntdUrl%22%3A%22www.btd-cmh.tq-tungsten.com%2F%22%2C%22pm%22%3A%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D%2C%22isBen%22%3Afalse%2C%22targetElement%22%3A%22window%22%2C%22instrUrl%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%22%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.242.145 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-242-145.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 10f126822afa54e8777ab803bd5202e59fd52c9406e8d1e38e7d8681577a9d1f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

vary: accept-encoding
content-encoding: br
etag: W/"aa8cacd5ffbdf95abd95a3558a299242"
x-amz-version-id: hfGNz0NDqz8WIvQNPbwmw_Lkn6i8QL_I
age: 85560
via: 1.1 da8cb5b9fb94d7de03d8eaa20297debc.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 867CKm4_yyoILAqFGlQyXaulSM_yUy2ejMsfTdG7Foz0Ffw1-yAfnw==
date: Wed, 23 Apr 2025 08:03:03 GMT
content-type: application/javascript
last-modified: Fri, 27 Sep 2024 17:33:16 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P1
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD5D 0
0 76ms
74ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD5D 0
0 73ms
73ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-fallback2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD5D 0
0 74ms
73ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD5D 0
0 55ms
55ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_style.css
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 4 KB
1 KB 48ms
44ms Stylesheet
text/css 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d911833ba09228d0286206fb929533c7039b52bed589023297c0fa3c63babbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

content-encoding: gzip
age: 13054
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:11:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:11:28 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 1122
x-xss-protection: 0
server: sffe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_style-mq.css
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 100 B
133 B 49ms
45ms Stylesheet
text/css 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_style-mq.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f10.1e100.net

Software

sffe /

Resource Hash

da874fd252d382469777cc64f02014e84887349b9d1603f467545a2b425296dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

content-encoding: gzip
age: 11938
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:30:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:30:04 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 103
x-xss-protection: 0
server: sffe

GET
H2 200 css
fonts.googleapis.com/ Frame 2265 26 KB
2 KB 199ms
82ms Stylesheet
text/css 142.251.40.106
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500,700,900

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.106 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

db7895e5e2054b0d0c7e613539f34d08ae665fa578cd17c36ff9b52e9ddeb5a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 07:49:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 24 Apr 2025 07:38:40 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f1.jpg
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 13 KB
13 KB 47ms
44ms Image
image/jpeg 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73c8b02fc80732586a259edbeec360ad74b8d6291a4e7de5ef4f89f941a8b756

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

age: 28579
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 23 Apr 2026 23:52:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 23 Apr 2025 23:52:43 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 13423
x-xss-protection: 0
server: sffe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_dell.png
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 5 KB
5 KB 45ms
42ms Image
image/png 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_dell.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196163cc4e90a5eb4c3620f839a1fe01488f0ea8abf4db06955f4b5d3849344c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

age: 28761
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 23 Apr 2026 23:49:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 23 Apr 2025 23:49:41 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 4938
x-xss-protection: 0
server: sffe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_logo.png
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 5 KB
5 KB 42ms
41ms Image
image/png 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2fa66410d851cc36136c8e3bc34bfc100f50c1fe399fbe34dbfb78821d72b998

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

age: 13129
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:10:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:10:13 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 4975
x-xss-protection: 0
server: sffe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f2.jpg
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 21 KB
21 KB 42ms
41ms Image
image/jpeg 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab903a2f62f8a8e48907eb43f18cf719c208ccdb4239f85453d25fcea0936a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

age: 13129
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:10:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:10:13 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 21592
x-xss-protection: 0
server: sffe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f3.jpg
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 27 KB
27 KB 46ms
34ms Image
image/jpeg 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d831c3095bd13252e11bfcb63b988f5c0cb68b9277878b463323960e972e460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

age: 13129
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:10:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:10:13 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 27716
x-xss-protection: 0
server: sffe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f4.jpg
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 28 KB
28 KB 35ms
33ms Image
image/jpeg 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f4.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

475735ea5421dec43f62778178cc374bf32f66957a1c3f3c4d7ba1ea99c7c17d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

age: 13129
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:10:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:10:13 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 29106
x-xss-protection: 0
server: sffe

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f5.jpg
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 13 KB
13 KB 48ms
47ms Image
image/jpeg 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_img-f5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ddd3328227d57df1161a9622698bfa4677e25f880dc95cefcb3dc1ba8863b31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

age: 12481
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:21:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:21:01 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 13423
x-xss-protection: 0
server: sffe

GET
H3 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.11.1/ Frame 2265 69 KB
25 KB 91ms
43ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.11.1/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbae080321632ad4ce06e9207ef9a534abd1d6488a96a0a4334fa768d1f93717

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "6313ba42-61b2"
age: 424552
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZVOxUND2R4cjoUtqd8rBGyuvQUsOp3F0HJt5rBT1wgBKjpUP%2BBphOYnXnqpP1Nl0HpamPrwGyopI0wUC7p3fgXsO%2BnIUF6TF8JTueoPcnql0O4BOuxvbtf3ebfdBTrWttjEIqWqp"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Tue, 14 Apr 2026 07:49:02 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 24 Apr 2025 07:49:02 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 03 Sep 2022 20:34:10 GMT
vary: Accept-Encoding
priority: u=2,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9354007479cdac81-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25010
server: cloudflare

GET
H3 200 bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_custom.js Show response
s0.2mdn.net/sadbundle/859638366976796280/ Frame 2265 2 KB
791 B 35ms
34ms Script
application/x-javascript 142.250.65.166
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_custom.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.166 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4bd1e0dd6241e0d591957c262fab1cbf26557a421497a9c6789a137a2f2d5be3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/859638366976796280/bb2504g0005_010_2567709_ca_cs_csb_csb_fy26q1w1_oa_dell-pro-family-ca_160x600_ccf_index.html?ev=01_253

Response headers

content-encoding: gzip
age: 13053
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 04:11:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 24 Apr 2025 04:11:29 GMT
last-modified: Thu, 13 Mar 2025 09:50:11 GMT
content-type: application/x-javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 761
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 8B14 43 B
855 B 570ms
296ms Image
image/gif 67.220.228.202
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

67.220.228.202 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: VHRS4FQ0TXMCD3X86DRP
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 24 Apr 2025 07:49:03 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B14
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZDkxYTY0YmIxOGNkMTc5YzI1NjdlZWIyMDM1ZGQ5YTBmM2FlN2RiOQ

170 B
188 B

48ms
48ms

Image
image/png

142.250.65.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZDkxYTY0YmIxOGNkMTc5YzI1NjdlZWIyMDM1ZGQ5YTBmM2FlN2RiOQ

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.65.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZDkxYTY0YmIxOGNkMTc5YzI1NjdlZWIyMDM1ZGQ5YTBmM2FlN2RiOQ
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 8B14
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/3Jg2eqk9wmdSoPaEsikCxcn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-tYXvjBZE2oIZT76Y2TVKL3ZEaeDB38OTvhbNBw--~A

42 B
1 KB

53ms
49ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-tYXvjBZE2oIZT76Y2TVKL3ZEaeDB38OTvhbNBw--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-tYXvjBZE2oIZT76Y2TVKL3ZEaeDB38OTvhbNBw--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 8B14
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

178ms
33ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0d6ee0ad-71da-4a47-b470-200f01f07af1&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 24 Apr 2025 07:49:02 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B14
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlWMkE5MTAtMVQtQk5FUg==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGyJroGEMcO7f7O4UQjeIiE&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TTlWMkE5MTAtMVQtQk5FUg==&google_push=

170 B
188 B

60ms
60ms

Image
image/png

142.250.65.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TTlWMkE5MTAtMVQtQk5FUg==&google_push=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.65.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 24 Apr 2025 07:49:03 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TTlWMkE5MTAtMVQtQk5FUg==&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 5e07703167439847c6c49a939083c0fd
content-length: 0
Content-Type: text/html

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 8B14 43 B
855 B 42ms
38ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 329E0Z36EEHZTW1TMNCA
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 24 Apr 2025 07:49:02 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 8B14
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=M9V2A910-1T-BNER&ex=d-rubiconproject.com&status=ok

43 B
479 B

45ms
44ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=M9V2A910-1T-BNER&ex=d-rubiconproject.com&status=ok

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 6SKDSVTCCQG23K2XKHT7
Content-Length: 43
Date: Thu, 24 Apr 2025 07:49:02 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=M9V2A910-1T-BNER&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2fcb300b847bad3e7dd1184ec8a1c2f5
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 8B14
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9V2A910-1T-BNER

0
144 B

60ms
56ms

Image
text/plain

150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9V2A910-1T-BNER
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: FA8E0B7EC1F34F3192DF7637E21E73A8 Ref B: YMQ31EDGE0313 Ref C: 2025-04-24T07:49:02Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzgXOQLSLCjPc2NAnjVw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9V2A910-1T-BNER
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 8B14
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELktxcDLqMaQkTXP-zfh_kM&google_cver=1

42 B
1 KB

187ms
33ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELktxcDLqMaQkTXP-zfh_kM&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 82a6cabd8b3f0d2d2ae6e86e2699f0ba
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELktxcDLqMaQkTXP-zfh_kM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 8B14
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAGeok7QE9oAABohz6XXlw&expires=30

42 B
1 KB

59ms
37ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAGeok7QE9oAABohz6XXlw&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e71ccbe96f42d70fa40603ada4c96b28
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAGeok7QE9oAABohz6XXlw&expires=30
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:02 GMT
Server: gunicorn
Connection: keep-alive

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame 8B14
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=M9V2A910-1T-BNER

43 B
1 KB

49ms
46ms

Image
image/gif

68.67.181.248
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=M9V2A910-1T-BNER

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

68.67.181.248 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 139.28.218.139; 139.28.218.139; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: b7ddc382-bacf-4adc-9cef-e8080c592dee
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Apr 2025 07:49:02 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=M9V2A910-1T-BNER
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
content-length: 0
Content-Type: text/html

GET
H2

200

ProfilesEngineServlet
syncv4.intentiq.com/profiles_engine/ Frame 8B14
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=M9V2A910-1T-BNER
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9V2A910-1T-BNER
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9V2A910-1T-BNER&ckls=true&ci=1JWLKbZY9n&nc=false&trid=857293010

43 B
1 KB

95ms
80ms

Image
image/gif

3.168.122.54
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9V2A910-1T-BNER&ckls=true&ci=1JWLKbZY9n&nc=false&trid=857293010
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.168.122.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-122-54.jfk52.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 2719b1b5cd0af422e4658c2da505a4d6.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: 7DhTf867Nu08PAGP6Nyo5IcoP0VuM4HJoElaB7Krik67Jm8IMXrKOg==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=M9V2A910-1T-BNER&ckls=true&ci=1JWLKbZY9n&nc=false&trid=857293010
pragma: no-cache
via: 1.1 2719b1b5cd0af422e4658c2da505a4d6.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: N1UavfU21JLWvWHa8d57OB4ONT64RKPECkc2U5GprHyqJyIduFNFrA==

GET
H3

200

pixel
capi.connatix.com/us/ Frame 8B14
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=M9V2A910-1T-BNER&pId=11&gdpr=&gdpr_consent=&us_privacy=

0
330 B

143ms
39ms

Image
text/plain

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=M9V2A910-1T-BNER&pId=11&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 93540075d93536fb-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=M9V2A910-1T-BNER&pId=11&gdpr=&gdpr_consent=&us_privacy=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
content-length: 0
Content-Type: text/html

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 8B14
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://prebid.a-mo.net/setuid/magnite?uid=M9V2A910-1T-BNER

0
729 B

294ms
119ms

Image
text/plain

147.75.98.193
PACKET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=M9V2A910-1T-BNER
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 147.75.98.193 Secaucus, United States, ASN54825 (PACKET, US),
Reverse DNS: omni-ny5-4va256
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Thu, 24 Apr 2025 07:49:02 GMT
x-envoy-upstream-service-time: 2
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.a-mo.net/setuid/magnite?uid=M9V2A910-1T-BNER
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
content-length: 0
Content-Type: text/html

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 8B14
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=M9V2A910-1T-BNER

68 B
323 B

34ms
34ms

Image
image/png

54.211.170.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=M9V2A910-1T-BNER

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.211.170.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=M9V2A910-1T-BNER
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
content-length: 0
Content-Type: text/html

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 8B14
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=M9V2A910-1T-BNER

95 B
124 B

68ms
67ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=M9V2A910-1T-BNER

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=M9V2A910-1T-BNER
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19ea072139d67f7022c6e463249c998e
Pragma: no-cache
content-length: 0

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B78F 44 KB
0 33ms
31ms Script
text/html 23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: b78af5b3a8efce8d4846d89d0b9b559a382b436d8b8d64cfc5bf53fdabc9893b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

Response headers

cache-control: max-age=51758
content-encoding: gzip
expires: Thu, 24 Apr 2025 22:11:39 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11386
date: Thu, 24 Apr 2025 07:49:01 GMT
last-modified: Wed, 23 Apr 2025 22:11:39 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 599A
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirectUri=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dsmart%26gdpr%3D0%26gdp...
https://elb.the-ozone-project.com/setuid?bidder=smart&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=3129260950073529854

0
467 B

70ms
68ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=smart&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=3129260950073529854
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 935400750b86ac3f-YYZ
expires: 0
content-length: 0
date: Thu, 24 Apr 2025 07:49:02 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

date: Thu, 24 Apr 2025 07:49:02 GMT
location: https://elb.the-ozone-project.com/setuid?bidder=smart&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=3129260950073529854
content-length: 0

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 8897 0
260 B 124ms
36ms Script
text/plain 207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 07:49:02 GMT
server: nginx

GET
H3 200 KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v47/ Frame 2265 39 KB
39 KB 99ms
34ms Font
font/woff2 142.251.40.131
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700,900

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f3.1e100.net

Software

sffe /

Resource Hash

20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://s0.2mdn.net
Referer: https://fonts.googleapis.com/

Response headers

age: 66943
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Apr 2026 13:13:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Apr 2025 13:13:20 GMT
last-modified: Wed, 08 Jan 2025 18:23:10 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 40128
x-xss-protection: 0
server: sffe

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 599A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-ozone&gdpr=0&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9V2A910-1T-BNER&gdpr=0

0
575 B

69ms
68ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9V2A910-1T-BNER&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 935400760c0bac3f-YYZ
expires: 0
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9V2A910-1T-BNER&gdpr=0
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
content-length: 0
Content-Type: text/html

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BA07 0
20 B 58ms
53ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bz0Cs7uwJaMndAt2FnboPh4XhwQcAAAAAOAHgBAI&bg=!np2lndLNAAZDHFaHYxw7ADQBe5WfOFGJkBxJj0Mjuv_EVuArW2rx3DORFnsgZgWkahTo3Q4wfWGEn1FK8PpbLSVypQtFAgAAAUdSAAAAHWgBB34ANWsBL2gPJ2RX28uVn0rgUL3X8TwnF3-Tmyr_MwKXQfovB3a-zM02Ev-rkyRUPQitCyaIPTEGCgC21gQTjfbQSPYkQ8B_cVzW_T0wxC8vWmU02rDHhxb5zyCxKl4KQ5lELew_o8bDAnW2oUls-oD7iiy5KhZvwoRj4n9PCVE92l4yyIclOe8eZ7QDhXb3ZPLaxGv0iIXW6ct4mEuHNDwgKJpY86YG_dxuDos7uy6I0ahQ8-Q2SM05wySCIWz8IVTmQCFVQLQev8EoBIr5QuN4_D80Z57hz1ZgrTcIJ7tjBYMbXbaQ7CHQ1ji4lbamB5yZAofF3dNHS8SdKFcA39ehPniL_vguqbBHwjOEBdXcJS_ofBlDY2hFUAW1U7Z8y6Ay3kKgpSu7tB3NG-yqCmOvQ7m6cf27A_sO6Zk7UKzxmA0_GhaS0gxb1K-Jlz_jkuEDNy5Bt2ydTV0UrAcGl2f5qbqPweeIktfPeQW0m_d6uNgvddzV37bYXy_TGWpA0ArQF4teO2geSKxoYA7op1vZoxpjv2klJg2QzOKrGgfotB57oSHMjX9AQuNtlQmIWzHYqsBAlPLqy0C7awlRCvDLG8oRXlmItRwbxup1tL5EhzZlk_yfoT8ve00NYl36ES0POzzns8fvCXQ-xlh4geAKei838L-S_CM4MfFZ1uRpmloKvNCB_dTxkY4lZ1FeMRKdnCyT-Y0mPPSr5bzNBMNbLxFYmoDqtj89EhN-tGBwLC8ZOvOxME8fwZk3cHYFWjync3_fGRhgwsorLQDjvfswLnhpvGysSJP5MKKLgD7xJ5NWhuiW3yBn0kqzBsNmdlfcDhEfq_csmpLuGVtgrw5dkIIt0ekVrclo3h1Rs-JxgBTldVmc3k2ydDFZ9NPyBe3X_j-hpqTJuT6IWjCwfB7ovuW9zT_u-Y_Df76YkshboT1UkXyBmF3otFqFRI24P7_6uWgAAtf6S-guXcPO4OXg2cbXJ4tSYbZiEK21LcBYR_ntARzhsSXhjMxqgLVFtixHGUfRx-MFxPKtYXfemW3qa5sRRt5fuF9My3_OXAXYLW4HVgW6dRtil4fMmV44Uf2lHLoNsjRok7XMzvfyPdu8k0Ypw5j2_jsoHz1GvI2aL2Mml6i-SVcs0dQk8CG3tLgOsKI75ymw9LmRp-CcC3Iu8D_bcL-NeJKdlg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 7B6B 1 KB
2 KB 52ms
51ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: ac9e2d01f9508270d72e93c04dda41ef57b4ab98b468163ab3c18c9de862748d

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1174
content-type: text/html; charset=utf-8
date: Thu, 24 Apr 2025 07:49:03 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame AD5D 0
0 65ms
64ms Fetch
image/png 142.251.40.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssNLLyJCwds29uiG3y-d5k-TnSeMlL95GdiAoy1byh2Asm31v6CeeRvweC6wmRt_tRLmfVNy46YV5zOT4RmKNxDOa3DvkRPXoGG3G0o6u9kowCsKKDvKoXZO0bzICCwrQLsnoy16Su3VI80TK7DolBURupDXYhrKHzXdTeDUv48-HJcCPumDaT5J_ht-3uLgwgIc6BzcoI00ut6IxpFEaPXRS6UmA&sai=AMfl-YRphAkNxKaOb5dqQkX2JvmymNyf6h-bX1Fl90tX4NKiLgf6bHy52YL-bJ4Rq9Mu0KTRJgJyrZorhRZEDICBrC1Ed-uuQXiyeFw&sig=Cg0ArKJSzCfKrEEh9-boEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9kZWxsLmNvbQ&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=982&vt=11&dtpt=673&dett=3&cstd=306&cisv=r20250423.09944&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 07:49:03 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"909077132":"0x355969b7d9a412810000000000000000","909077133":"0x413c40176642df980000000000000000","909077134":"0x298d4e78226f79430000000000000000","909077135":"0xf494cbe0b4681af40000000000000000"},"debug_key":"13389955527098300943","debug_reporting":true,"destination":["https://dell.com","https://alienwarearena.com","https://delltechnologies.com"],"event_report_windows":{"end_times":[86400,604800,2592000]},"expiry":"2592000","filter_data":{"14":[],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["9632645"]},"max_event_level_reports":2,"priority":"0","source_event_id":"4522398535829249253"}
server: cafe

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 7344 20 KB
7 KB 48ms
47ms Document
text/html 23.45.193.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=51e0bc8d-5434-429d-9324-8bef60b2a3e4&linkedin.com=76fc432d-12fb-4d21-a104-f5d81c0c2568&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745480940534&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.193.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-193-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://elb.the-ozone-project.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=66941
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 24 Apr 2025 07:49:03 GMT
expires: Fri, 25 Apr 2025 02:24:44 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

xuid
eb2.3lift.com/ Frame 7B6B
Redirect Chain

https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=7255&xuid=AAGeok7QE9oAABohz6XXlw&dongle=bzwx&gdpr=0

37 B
474 B

51ms
50ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7255&xuid=AAGeok7QE9oAABohz6XXlw&dongle=bzwx&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://eb2.3lift.com/xuid?mid=7255&xuid=AAGeok7QE9oAABohz6XXlw&dongle=bzwx&gdpr=0
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:03 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 7B6B 43 B
168 B 34ms
33ms Image
image/gif 34.198.110.147
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=20&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.110.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-110-147.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 24 Apr 2025 07:49:03 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 7B6B 43 B
168 B 66ms
31ms Image
image/gif 34.198.110.147
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=114&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.110.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-110-147.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 24 Apr 2025 07:49:03 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 7B6B
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://eb2.3lift.com/xuid?mid=3702&xuid=${ADELPHIC_CUID}&dongle=d54f&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3702&xuid=272289c1-f149-42b2-8a3d-50b867952af3&dongle=d54f&gdpr=0&gdpr_consent=

37 B
474 B

40ms
40ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3702&xuid=272289c1-f149-42b2-8a3d-50b867952af3&dongle=d54f&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

Redirect headers

X-CI-RTID: a194839d-b1e8-49c0-b7fb-bc6a53c60b64
Location: https://eb2.3lift.com/xuid?mid=3702&xuid=272289c1-f149-42b2-8a3d-50b867952af3&dongle=d54f&gdpr=0&gdpr_consent=
Content-Length: 149
Date: Thu, 24 Apr 2025 07:49:03 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 7B6B
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=83&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&partner_url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3646%26xuid%3D1257...
https://eb2.3lift.com/xuid?mid=3646&xuid=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&dongle=1fa5&gdpr=0&gdpr_consent=

37 B
474 B

35ms
34ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3646&xuid=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&dongle=1fa5&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=3646&xuid=1257f8d2-2a25-4fb3-9ffe-b6bae64b5ebe-6809eced-4341&dongle=1fa5&gdpr=0&gdpr_consent=
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
server: Jetty(11.0.25)

GET
H2 200 sync
x.bidswitch.net/ Frame 7B6B 43 B
92 B 64ms
60ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=triplelift&user_id=2063625799056981396200&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

GET
H2

200

xuid
eb2.3lift.com/ Frame 7B6B
Redirect Chain

https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=4771&xuid=4292834802220618442&dongle=d407&gdpr=0&gdpr_consent=

37 B
474 B

85ms
83ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=4771&xuid=4292834802220618442&dongle=d407&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://eb2.3lift.com/xuid?mid=4771&xuid=4292834802220618442&dongle=d407&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 24 Apr 2025 07:49:04 GMT

GET 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame 7B6B 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame 7B6B
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://b1sync.outbrain.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&s=2
https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&obuid=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&s=2
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&gdpr=0

37 B
474 B

42ms
37ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=a7fe2569-abbd-4df8-9e9b-3cb3a172b8ac&gdpr=0
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 131
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 7B6B
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=D192F3DBA01445EB85AFED28BB6B85E2&dongle=yf3

37 B
474 B

53ms
53ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=D192F3DBA01445EB85AFED28BB6B85E2&dongle=yf3
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://eb2.3lift.com/xuid?mid=7969&xuid=D192F3DBA01445EB85AFED28BB6B85E2&dongle=yf3
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 23 Apr 2025 07:49:03 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 200 setuid
prebid.intergient.com/ Frame 7B6B 0
1 KB 57ms
55ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=2063625799056981396200
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745480943&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=cXZsDyzvLSC3jpkufVxqYtSsK0xBLrzMjd1458PCmPE%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745480943&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=cXZsDyzvLSC3jpkufVxqYtSsK0xBLrzMjd1458PCmPE%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93540076dc9939f4-YYZ
server: cloudflare

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 599A
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
https://elb.the-ozone-project.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=

0
84 B

89ms
87ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93540077cd0fac3f-YYZ
expires: 0
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 07:49:03 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 7344 2 KB
2 KB 29ms
28ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=38972648&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 5635a04e00c55d354f0b47220063ac2aeae0fcaabe1a71fa7054f285bda2427e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 2019
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame B78F 7 B
1 KB 45ms
44ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=M9V2A910-1T-BNER
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 7D11 0
339 B 180ms
107ms Document
image/gif 38.91.45.7
COGENT-174

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Thu, 24 Apr 2025 07:49:03 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 5C90
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=lUBQHlYbUtliXwbV-BUdQIsc2os&gdpr=0&gdpr_consent=

42 B
377 B

33ms
31ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=lUBQHlYbUtliXwbV-BUdQIsc2os&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 24 Apr 2025 07:49:03 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Thu, 24 Apr 2025 07:49:03 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=lUBQHlYbUtliXwbV-BUdQIsc2os&gdpr=0&gdpr_consent=

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 4B3B
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
153 B

17ms
17ms

Document
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAns7wAAsBqW0gBT
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 364
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 24 Apr 2025 07:49:03 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 79
x-robots-tag: noindex
x-served-by: cache-yul1970033-YUL
x-timer: S1745480943.349977,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAns7wAAsBqW0gBT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-yul1970033-YUL
x-timer: S1745480943.313384,VS0,VE16

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame EC54
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=979321856528761373

42 B
273 B

34ms
34ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=979321856528761373
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 24 Apr 2025 01:44:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:03 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=979321856528761373
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 4B35
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGeok7QE9oAABohz6XXlw&gdpr=0&gdpr_consent=

42 B
309 B

70ms
69ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGeok7QE9oAABohz6XXlw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 24 Apr 2025 07:48:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:03 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAGeok7QE9oAABohz6XXlw&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2 200 sync Show response
x.bidswitch.net/ Frame C8FD 43 B
92 B 109ms
102ms Document
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif
date: Thu, 24 Apr 2025 07:49:03 GMT
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 67AD
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=ab193b52-0198-4547-bf39-047745b96aa4&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E

42 B
491 B

45ms
44ms

Document
image/gif

44.209.179.52
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.209.179.52 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-209-179-52.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Thu, 24 Apr 2025 07:49:03 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 24 Apr 2025 07:49:02 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 setuid Show response
elb.the-ozone-project.com/ Frame 0D7D 0
745 B 78ms
72ms Document
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/setuid?bidder=pubmatic&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93540077bd05ac3f-YYZ
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
expires: 0
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 7344 43 B
651 B 810ms
186ms Image
image/gif 108.138.128.44
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-44.jfk50.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 25c8a58d4773aeef98fa0f0f950689bc.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif
x-amz-cf-pop: JFK50-P4
server: AAWebServer
x-amz-cf-id: S5EHUMHEa7O6CNdU-TzauAe0Tf9h3rw_ia6RoMtUiRYet6-LT6L4ZA==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame 7344 49 B
221 B 128ms
89ms Image
image/gif 54.205.146.164
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.146.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-146-164.compute-1.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/gif

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 7344
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=e39abf00-e651-4c00-bb6e-47e1d960b8a2%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=0d6ee0ad-71da-4a47-b470-200f01f07af1&ttd_puid=e39abf00-e651-4c00-bb6e-47e1d960b8a2%2C%2C

95 B
124 B

63ms
63ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=0d6ee0ad-71da-4a47-b470-200f01f07af1&ttd_puid=e39abf00-e651-4c00-bb6e-47e1d960b8a2%2C%2C

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=0d6ee0ad-71da-4a47-b470-200f01f07af1&ttd_puid=e39abf00-e651-4c00-bb6e-47e1d960b8a2%2C%2C
content-length: 359
date: Thu, 24 Apr 2025 07:49:03 GMT
server: Kestrel

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame 7344
Redirect Chain

https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=0d6ee0ad-71da-4a47-b470-200f01f07af1
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=0d6ee0ad-71da-4a47-b470-200f01f07af1

43 B
302 B

180ms
64ms

Image
image/gif

50.19.215.200
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=0d6ee0ad-71da-4a47-b470-200f01f07af1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

50.19.215.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-19-215-200.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 566b69ffe0f284f9
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Thu, 24 Apr 2025 07:49:03 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=0d6ee0ad-71da-4a47-b470-200f01f07af1
Content-Length: 0
Date: Thu, 24 Apr 2025 07:49:03 GMT
trace-id: 99e520f0e4623e2d
Request-Time: 1
Connection: keep-alive

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 7344
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=1bb4a9f0cbed1107&is_secure=true&networkId=17100&version=1&nuid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAHDFz488vWvAIg7i21AQEBAQEBAQCXZ8SGEwEBAQEBAQEB&expiration=1745567343&nuid=D4CE65B4-681D-4B...

42 B
450 B

37ms
35ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAHDFz488vWvAIg7i21AQEBAQEBAQCXZ8SGEwEBAQEBAQEB&expiration=1745567343&nuid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 01:44:17 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAHDFz488vWvAIg7i21AQEBAQEBAQCXZ8SGEwEBAQEBAQEB&expiration=1745567343&nuid=D4CE65B4-681D-4B8F-B6EF-2DF7E339D81E&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
pragma: no-cache
server: nginx

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 7344
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4292834802220618442&gdpr=0&gdpr_consent=&us_privacy=

1 B
322 B

38ms
36ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4292834802220618442&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 01:44:35 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4292834802220618442&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 24 Apr 2025 07:49:20 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 7344
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R37AA2_1274386B3_78ED718F&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

36ms
35ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.68.201.140 Ashburn, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-428485743; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-428485743; includeSubDomains
Cache-Control: no-cache
Date: Thu, 24 Apr 2025 07:49:03 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 24 Apr 2025 07:48:57 GMT
server: nginx

GET
H2

200

cs
cs.yellowblue.io/ Frame B78F
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&khaos=M9V2A910-1T-BNER
https://cs.yellowblue.io/cs?aid=11590&id=M9V2A910-1T-BNER

0
355 B

32ms
31ms

Image
application/javascript

54.209.234.247
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11590&id=M9V2A910-1T-BNER
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 54.209.234.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-234-247.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://eus.rubiconproject.com/
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cs.yellowblue.io/cs?aid=11590&id=M9V2A910-1T-BNER
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b4dd0c0269c7ea77b4c8a6cf555d0a1d
content-length: 0
Content-Type: text/html

OPTIONS
H2 200 shadowEvent
tungsten-service.prod.na.adsqtungsten.a9.amazon.dev/csm/ Frame 0
0 214ms
95ms Preflight 18.164.124.34
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tungsten-service.prod.na.adsqtungsten.a9.amazon.dev/csm/shadowEvent
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-34.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://aax-us-east.amazon-adsystem.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date,smithy-protocol
access-control-max-age: 172800
content-length: 0
date: Thu, 24 Apr 2025 07:49:03 GMT
via: 1.1 62c27224785ce0e5201a4eab3d49262e.cloudfront.net (CloudFront)
x-amz-cf-id: w60MszrMTHNWfgF4nObRndpkOiqcf5NykdwCnhI7yvlsTlDFft8afw==
x-amz-cf-pop: JFK50-P7
x-amzn-requestid: b59b4828-6849-493b-af9e-2404f078f92b
x-cache: Miss from cloudfront

POST
H2 200 shadowEvent Show response
tungsten-service.prod.na.adsqtungsten.a9.amazon.dev/csm/ Frame AD5D 2 B
368 B 44ms
39ms Fetch
application/json 18.164.124.34
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tungsten-service.prod.na.adsqtungsten.a9.amazon.dev/csm/shadowEvent
Requested by: Host: ts.amazon-adsystem.com
URL: https://ts.amazon-adsystem.com/tg/resources/tq-forensics/pst/adforensics_csmcollection.js?bidRequestId=9sgDlkLsiTe3oPyk6JqsfA&srcName=CS&gdprConsent=true&campaignId=579211905739005201&ep=%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D&creativeId=588298352861780384&bidId=V6MAbNDSYsmxl0it.b6Cyw&advertiserId=587186333253426960&clickDestnUrl=https%3A%2F%2Fwww.dell.com%2Fen-ca&gdpr=0&tungstenCSMLoggingFrameworkUrl=tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F&tsEndpoint=https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F&adId=590123298235643965&au=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%24%7BAAX_TYPE%7D%26p%3D%24%7BAAX_PAYLOAD%7D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ&zone=USEast&is3p=true&ntdUrl=www.btd-cmh.tq-tungsten.com%2F&pm=%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D&isBen=false&targetElement=window&instrUrl=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F&sourceid=600&expname=UNITAG_DISPLAY_ROLLOUT_5500&expbucket=T&sourcetype=dtb&traffictype=web&mediatype=display
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-34.jfk50.r.cloudfront.net
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date,smithy-protocol
x-amzn-requestid: fca70c9f-1882-42f2-87bf-8f0a8327ddb6
via: 1.1 62c27224785ce0e5201a4eab3d49262e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 2
x-amz-cf-id: 0z10pw1gUEgohyfHx6s8wWotqLX7s33lFYqhxElLyDiDK9ZOopZilw==
date: Thu, 24 Apr 2025 07:49:03 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P7

POST
H2 200 collect_ntd Show response
www.btd-cmh.tq-tungsten.com/ Frame AD5D 28 B
78 B 93ms
92ms Fetch 3.17.17.43
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://www.btd-cmh.tq-tungsten.com/collect_ntd
Requested by: Host: ts.amazon-adsystem.com
URL: https://ts.amazon-adsystem.com/tg/resources/tq-forensics/adforensics_basic.js?bidRequestId=9sgDlkLsiTe3oPyk6JqsfA&srcName=CS&gdprConsent=true&campaignId=579211905739005201&ep=%5B%22ara%22%2C%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D&creativeId=588298352861780384&bidId=V6MAbNDSYsmxl0it.b6Cyw&advertiserId=587186333253426960&clickDestnUrl=https%3A%2F%2Fwww.dell.com%2Fen-ca&gdpr=0&tungstenCSMLoggingFrameworkUrl=tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F&tsEndpoint=https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F&adId=590123298235643965&au=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRFejAGzQ0mLJsZdIrf2-gssAAAGWZsV_4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F%3Ft%3D%24%7BAAX_TYPE%7D%26p%3D%24%7BAAX_PAYLOAD%7D%26bx%3Dv1_CGrnRwMqqcSu4CywW9sgmCXoUXMlcKMuur59nmLSr5PhUspwmq0iNM0X5R8auRi-oYQA7Y9Yi3uQtj_na1tVFlcb_0_jLqiJThBVPxsqEQrxRt0h42Mty6UyDxS-YbX8Ed_XZU2s65FITRp8yw2DFhoTZhBSWJMlWAw8CfhlBkvQl7bw1AdlAA3hasSya_FyXylCIIKEwkk1Qm92OI0QIvMIi8601scgBRbQO6k0kQkW8IRhkfaqQ0M6gEX-z19BQmbxPODDuBR1z1QbL8lzOA_hQCCKhSDDFfGU1LjMS5MRIAWD5YWv0j3CKirhH5ao7PId1e5vY_30tYPeMcvpL9h90-52fRRqlfcS3_poGrViyGVXX0iV0RSQ9pY6eXOcSyZPg0G_o00inw-sNo6xZzp7as7Gp-hLSsolYUNUgwx7Nt1wghRrIUNx0apxZ15zBLifTNvwi9aDQyIocii4lMExYXazvXTrTQ5VJdJNn-H5LUhP7qO8zGPLUHRjKbOOhf1qzC9rJupetCCB2XOn8WTnaRpifU8LAAnZfA_cOa77VCqEED165F42GQrTS03JYMIjt_Rzcjypnbd8qJ8EI1fCaTU8nS1m9t5s1eXMxBpb-tTwgfBLNhGkpEhJAeLAcUsycPMXGzNl3sgVBbpi7mBqho77HQRaRFBRmdNz9rkvcxtgBHjImXMT8JO3h-MGSignrB5K_xVldA0UsQ&zone=USEast&is3p=true&ntdUrl=www.btd-cmh.tq-tungsten.com%2F&pm=%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22au%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22au%22%5D%7D&isBen=false&targetElement=window&instrUrl=https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJFejAGzQ0mLJsZdIrf2-gssAAAGWZsV6LAEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBvkMH7%2F&sourceid=600&expname=UNITAG_DISPLAY_ROLLOUT_5500&expbucket=T&sourcetype=dtb&traffictype=web&mediatype=display
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.17.17.43 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-17-17-43.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 7c685f0d03cd8a4fc967bc7b48fb67dce20412fb492552f3a911ea339fd42c0a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

access-control-allow-origin: *
content-length: 28
date: Thu, 24 Apr 2025 07:49:03 GMT
vary: origin, access-control-request-method, access-control-request-headers

GET /
sq-tungsten-ts.amazon-adsystem.com/noop/ Frame AD5D 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8EEA 0
0 69ms
57ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssnZMe_pflqTdpfKSICyyBydQf7SSgNkfgeG6fWtQbrmvpPS4-CNdAHtWv1aOPphGi9D6uxggGPvA5fkGkREGUBr1A3y5NQKwp6BkC21RBLiuCdCK2CXKFfeCGIlA6ttslv5KLBOi1l3uJwtDh184YQY8rVmrSlZ6gU8GI6AK2brCCaQrU20R8Q8JF4zAxW1c0kioKTm2z9trhZzaALJaRe6OOoSrpdW6lT8_4g_kMyxCJ0O8BRxMfwVOdySPegIgcNKAU5Z_6cKKNypWPtsxzZpYB_guWWpFTO2AFLaFala245nSQeG4C_28amNpXJMog9o9eB2BvA23CHUbiFRzp5A_Cn5C2ESuwv-ZB8LY9lqK56P8Si7SXOAkdfwac4KOkMrTUa0x-f0IO257BFiFWJRXq5wRx3Y-xM1mToWTKzhMGtq4V4O7LSbdTVoVTojyra5tnLYzBNEvf7tKW1b9Bu9p3vt-FEI7fTtEwSmfCjqM-jow8kWUGcB7A4EG910NGq_wxfoSxl4GTRRwrBSjYNv3DHSfmVpggymkll11x20FDk5uur_Fle7CmjSBTJLn6AxcCL3r4mKB3B6zX_rjMxHFqKNL_G&sai=AMfl-YQ-0rNATGCH6SyTm0uBP35_yGeldHooFblTl9qEcRfaUCGRC5AErY1ixuqUtF3tlUXLG1hMhRUjBfhI97BgrLHp_n6lp3kkGSBXLezSaMNIoPnLv5aBYxgCHkA&sig=Cg0ArKJSzNirjBI9nTmSEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS