paint.toys Open in urlscan Pro
15.197.167.90 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.avasporelight.com/fdwlngjfaxlnamjyjproxjqvnicxsvRSmZYUk9KcDUwZ3hDM1ZWaHRyUmYtMjY5MC0yNjc2NzMwMC0xMDA3MDI3MS0zODM2LVZjM0xWa2NvNW9UY2tqWEdMc05h/4rnw32yifufix0ntsxyddrrnwl7cqq17p/uqhtcf/zadtyjn7u2pa6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 76255
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Sat, 26 Apr 2025 01:49:33 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JSQWJ7J5T2V0TQ2TNV3N5RPC

Redirect headers

accept-ranges: bytes
age: 76255
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Sat, 26 Apr 2025 01:49:33 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JSQWJ7DVSV3S33291SHD34SN

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 613ms
435ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7be1c6da402153304c6fe3beb0c2661e03601b02c4323236439c1d8d77477fea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-ray: 93626c9eddaf88ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 91ms
90ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 4012
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JSQWJ7N943J0K70RQEZTE8RA
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:49:33 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 92ms
91ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 76253
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JSQWJ7N9VFWJCA83QQ4MG31R
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:49:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 91ms
90ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 4012
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JSQWJ7N9QCT0025867B4T0W9
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:49:33 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 137ms
136ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 4012
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JSQWJ7N93PXZEY5FR0NAMEQN
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:49:33 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 183ms
178ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 4013
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JSQWJ7RAW9YSK4X672H3FCJ1
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:49:33 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 97ms
93ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 4012
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JSQWJ7RAG53M3D0B3Q2RTJTE
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:49:33 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 144ms
63ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2c165397b0d19ac881b695e57343e24fa8bb78cbcc9c171e899177828213779

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 93626c9eddb088ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:33 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 366 KB
123 KB 514ms
216ms Script
application/javascript 2404:6800:4006:80a::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:80a::2008 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9fddf886fe5b4a4468dac5d4c99cd71f743cdd0e9217d6b3f66b3fae45995957

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
expires: Sat, 26 Apr 2025 01:49:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
content-length: 125271
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ca6bde09737649d_4398cbb3d2db528f5cbb.v1.js Show response
faucetfoot.com/static/3160c21523d58/ 68 KB
25 KB 616ms
217ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/static/3160c21523d58/ca6bde09737649d_4398cbb3d2db528f5cbb.v1.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

bc820a5b9c737fe559a85c289fbc2d95e27c135426c1e8244107296258fb5069

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"ee4603b75cc6900e75c7539393422eb50670776ecae6e3d4b28714a8c4173955"
via: fen-hoothoot-asia-east1-p67b.gce-asia-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 419ms
211ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

975f4ad038bc794a4496398cfcd61a9be241e12d0af8db78f333255090d313b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 366 / 20204 / m202504220101 / config-hash: 18116493962408344416
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 01:49:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33902
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 76ms
75ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 964
cf-ray: 93626ca1a86988ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 411 B
363 B 67ms
67ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cbab43d2db3b77efdbf5cae66c7f8e202c70b3c136237f4f977bef40d86507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"a2f607b2abbb34303d7b9531c1a9ebcc"
age: 3811
cf-ray: 93626ca1a86b88ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.816717f0fefdba312f2f.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
2 KB 100ms
99ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faa04735dd36414ea1be1f8e0ecce4c41f47ccc65c94e754c4073e1f6a59c115

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"cd64d4c5fb9e686de5a9d31f5c6e1020"
age: 3810
cf-ray: 93626ca208c788ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.25cd0c88862d62596ad5.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 462 KB
140 KB 101ms
100ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f0fb98629bdcde55be36d3852ea70d065674c404f1c63380b750816c5050720

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"a83125d38dc322a379d22cc11148e4b4"
age: 3810
cf-ray: 93626ca208c888ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 559 B
444 B 58ms
55ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 3600
cf-ray: 93626ca40b0888ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame C1B1 503 B
427 B 203ms
56ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 2164
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93626ca51879afce-PER
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:49:34 GMT
hw-country-code: AU
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame FEA2 503 B
0 199ms
199ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 2164
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93626ca51879afce-PER
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:49:34 GMT
hw-country-code: AU
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 TIER_1 Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/21/desktop/Chrome/ 583 B
920 B 369ms
95ms XHR
application/json 2600:9000:2212:b000:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/21/desktop/Chrome/TIER_1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2212:b000:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 5399f48b3edaf8dfee67bd7747f1e2e664513d5b97857424ebdcc308022b4499

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 2817
via: 1.1 332185989ef2da97d1a56bdaee204b78.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 583
x-amz-cf-id: gk2rGpKqAPVndmNSumSxCX79z5rgrUnJDUcffb8UVmKvqZv-VH8mDA==
date: Sat, 26 Apr 2025 01:02:38 GMT
content-type: application/json
x-amz-cf-pop: SYD62-P1
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 150 KB
39 KB 157ms
54ms Script
application/javascript 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8545960ff64a63492ec5697a7ad530029d5b1ed616dfb381ab4e24e32cdf763

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "729091b4a235c6f5248e31a198c358b1"
via: 1.1 google
cf-ray: 93626ca4ff26709e-PER
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39874
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: application/javascript
last-modified: Sat, 26 Apr 2025 01:45:41 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 358 KB
86 KB 310ms
104ms Script
application/javascript 108.158.28.226
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.28.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-28-226.syd3.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3e7cec086c6f1c8c57de8561ce5bb8488e68b27391b0d6e8fb0ee471b9de187f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"4173e93caf83178c49bea9e2ca115e00"
age: 2365
via: 1.1 8bec138951dfffa4e8e0ac983bb30e76.cloudfront.net (CloudFront), 1.1 d5a7b4f0ce5b27d5b6750a1a5f7fd024.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: qpbTcjUP4x_1fFre7n0fisbyG3htNPoBkDXW5pJhQrAj0Ps-yDQwJA==
date: Sat, 26 Apr 2025 01:10:10 GMT
content-type: application/javascript
last-modified: Mon, 21 Apr 2025 17:15:50 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P1, SYD3-P2
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
586 B 164ms
48ms Image
image/gif 2606:50c0:8000::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8000::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: ff0991fa0bc1421edeba3b9958f490de8b5d07cd
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 0DB9:1E58AB:450EEB:C0B8C4:67EB1777
expires: Sat, 26 Apr 2025 01:54:34 GMT
x-cache: HIT
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: image/gif
x-served-by: cache-per12620-PER
x-cache-hits: 13
source-age: 160
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1745632175.886515,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 326ms
110ms Script
text/javascript 108.158.20.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.20.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-20-59.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 41889
via: 1.1 13f78fbcf1cf5a45dca12f9d22e82f46.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: CiOPxgytn2iY3UQVbGpqAb9Ngkty23gix4QB5R-rXI0rYiu8ZvsquA==
date: Fri, 25 Apr 2025 14:11:27 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P3
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
109 KB 214ms
213ms Script
application/javascript 2404:6800:4006:80a::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54n0v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:80a::2008 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e39d7672a9348366e0c93fb5f52c6998fc501dca10dd3ea32ffdfcd3c8212fc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
expires: Sat, 26 Apr 2025 01:49:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
content-length: 111333
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 589ms
196ms Fetch
text/plain 2404:6800:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54n0v9101576445za200&_p=1745632173709&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&cid=1287109666.1745632175&ul=en-au&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745632174&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.avasporelight.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2849
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4006:809::200e Sydney, Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/ 529 KB
167 KB 98ms
97ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a18f1d1a038a61a76a04b783020b0f52bcd997b4b83015b566a8f3e9093c2e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4745022393092336697
age: 12854
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 22:15:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 25 Apr 2025 22:15:20 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170786
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504240101/ 63 KB
23 KB 194ms
193ms Other
text/plain 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504240101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02b8824bd47ff5abde631d5dad8206e74bf7aea212f3873eda3c9dfb37d1fcea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17736166072191226177
age: 1197
x-content-type-options: nosniff
expires: Sat, 03 May 2025 01:29:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 01:29:38 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23361
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504240101"

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
547 B 193ms
59ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 887731
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIteM8kBiwO4-XkKx_JoJOyot5g37ar484KxV7NtbEDAX8_KDlpVMrkQDICa68Gumc-W-uehp_k
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 93626ca63d13866a-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 416ms
100ms Image
image/x-icon 142.250.204.6
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s25-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 35941
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 15:50:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 25 Apr 2025 15:50:34 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 198ms
65ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.3497886988470248
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 887731
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIteM8kBiwO4-XkKx_JoJOyot5g37ar484KxV7NtbEDAX8_KDlpVMrkQDICa68Gumc-W-uehp_k
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 93626ca63d14866a-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame C1B1 17 KB
7 KB 57ms
56ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3787
cf-ray: 93626ca578f8afce-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame FEA2 17 KB
0 49ms
48ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3787
cf-ray: 93626ca578f8afce-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:34 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET a015c97e-cfff-4b03-afa0-c041b8acbeb2
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 465ms
141ms Preflight
application/json 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 26 Apr 2025 01:49:34 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 209845
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 127ms
59ms XHR
application/json 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 37887
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745582090&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=Q%2BUV1fpvtCzGJLiQpL%2BrY61sTTavVGEw4RP1Cgxp21E%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Fri, 25 Apr 2025 11:54:50 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745582090&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=Q%2BUV1fpvtCzGJLiQpL%2BrY61sTTavVGEw4RP1Cgxp21E%3D
hw-country-code: AU
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 93626ca67b426e81-PER
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
1 KB 59ms
57ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 3806
cf-ray: 93626ca60df488ca-PER
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 936ms
307ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/fdwlngjfaxlnamjyjproxjqvnicxsvRSmZYUk9KcDUwZ3hDM1ZWaHRyUmYtMjY5MC0yNjc2NzMwMC0xMDA3MDI3MS0zODM2LVZjM0xWa2NvNW9UY2tqWEdMc05h/4rnw32yifufix0ntsxyddrrnwl7cqq17p/uqhtcf/zadtyjn7u2pa6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 561bc1fe70e08b336c34944d315f780d7529b9dd6bdb58a90876345d170c4c70

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 444 KB
141 KB 621ms
237ms Script
text/javascript 2404:6800:4006:814::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:814::200a Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8175cb0c911b8a6f52bf56e2c7350936bf17b460dec45b70aa87b469fd51b9bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8184156583072042479
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 01:49:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 143605
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 1043ms
345ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-203-223-119.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
855 B 325ms
117ms Fetch
application/json 3.1.104.200
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.1.104.200 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-104-200.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 3855339f822a6c4c09c33e52fe8634972d3a4d0ad2505934ea5b37e37ca35df7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
683 B 824ms
236ms Fetch
application/javascript 44.239.95.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.239.95.117 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-95-117.us-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: aeaf93d5221ed404e5d941c10871579629f4846fd5c6ecb5db1dc1b732425cef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 464ms
245ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 0f699547b376604a899f47a0135f7a7989877dd2cd1b66bdd4384e84e0e6d2d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
367 B 941ms
310ms Fetch 52.203.223.119
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jsqwj8y3pwpyq8ybmr1r2eq2&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.203.223.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3599, private
trace-id: cd56447b73efa8f9
request-time: 1
access-control-allow-credentials: true
expires: Sat, 26 Apr 2025 02:49:35 GMT
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:35 GMT
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=KDobQHwwVldxY0FpMnh4ZUNOeGxmN3pJNjNva3BTTFYvdDRpcG91Y2VBdWJ0dEQ3bWpnUXlpZkpNTWdwRmxKMkhDNExrbzFUc1JrS3hQUzVTTG8wTk9sdk1lOHphY2tQaDM2ZTRJQndjY013OUViSzFKV3QyRmljUFZ6VU...

367 B
952 B

291ms
97ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=KDobQHwwVldxY0FpMnh4ZUNOeGxmN3pJNjNva3BTTFYvdDRpcG91Y2VBdWJ0dEQ3bWpnUXlpZkpNTWdwRmxKMkhDNExrbzFUc1JrS3hQUzVTTG8wTk9sdk1lOHphY2tQaDM2ZTRJQndjY013OUViSzFKV3QyRmljUFZ6VUkvbmo5MjJLZjJobjdJOFdSdFV4d2Z3SVdsQVJsSjFWN0NiK29KWnBoUE9MZGJaQmtGaEdTNHVxZllLdTdTWjVRREN5aFY3ZXdvQ1UzeTM3dXMzbnpaSkpMblpRYVJSNjhWblRMNENXeVFSVmhkYUZQZmU4PXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

b9418fab4e28987c0a8336f8e9e73211a2c77ac5fb34d173c1d39b3dcac34f64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 452020
expires: 0
access-control-allow-origin: null
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=KDobQHwwVldxY0FpMnh4ZUNOeGxmN3pJNjNva3BTTFYvdDRpcG91Y2VBdWJ0dEQ3bWpnUXlpZkpNTWdwRmxKMkhDNExrbzFUc1JrS3hQUzVTTG8wTk9sdk1lOHphY2tQaDM2ZTRJQndjY013OUViSzFKV3QyRmljUFZ6VUkvbmo5MjJLZjJobjdJOFdSdFV4d2Z3SVdsQVJsSjFWN0NiK29KWnBoUE9MZGJaQmtGaEdTNHVxZllLdTdTWjVRREN5aFY3ZXdvQ1UzeTM3dXMzbnpaSkpMblpRYVJSNjhWblRMNENXeVFSVmhkYUZQZmU4PXw&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 240421
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 26 Apr 2025 01:49:35 GMT
server: Kestrel

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_23fd900a-f45d-4bbe-9362-ef71ce5d40b8_1745632175013
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_23fd900a-f45d-4bbe-9362-ef71ce5d40b8_1745632175013

1 KB
1 KB

99ms
98ms

Script
application/javascript

54.153.211.209
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_23fd900a-f45d-4bbe-9362-ef71ce5d40b8_1745632175013
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.153.211.209 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-153-211-209.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: 0118ff371d4232737b160777a9a4e9c0bc6eff60b8cb3b2e1452943cc3fcd518

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1130
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:49:35 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_23fd900a-f45d-4bbe-9362-ef71ce5d40b8_1745632175013
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:49:35 GMT

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 905ms
282ms Image
image/gif 2600:9000:25f0:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?service=ad&adid=zaaegs&adnum=234701
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f0:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 33064
x-cache: Hit from cloudfront
x-amz-cf-id: 1n4SohZ4Vr_y_cNTL8MHSbfrR2VxaDBk5fkUkBXRnrT_Jz-QtlIhcw==
date: Fri, 25 Apr 2025 16:38:32 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 fcfb767b5ad15bbc6d9e5b12d89c5172.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: SFO53-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 333ms
108ms XHR
application/json 3.0.62.43
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.0.62.43 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-0-62-43.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: f1f8c308d91aac7653e1638d930abb59a69861afad9f842614808de47906b3da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=utf-8

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 288ms
99ms XHR
application/javascript 108.158.28.226
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.28.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-28-226.syd3.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 82668
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: Svf1UlQUw6m1xFTR2RJy2qtwpUGxIHM_zLp6sUJghcyBJCwL5UPW-w==
date: Fri, 25 Apr 2025 02:51:48 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 352b1001018ea123117ef28ad154f522.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: SYD3-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 292ms
97ms Script
application/javascript 108.158.32.16
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.32.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-32-16.syd3.r.cloudfront.net
Software: CloudFront /
Resource Hash: ab6d8f57879cd6d3aab93562880a346c4c624f60538d9eeb733c81a1a9dec964

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 343
via: 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: Kq3DZu0yZAv5BTuInycQcDWbgYyWnMfF2ItMbEaZYNno2BQDNPHRSg==
date: Sat, 26 Apr 2025 01:43:52 GMT
content-type: application/javascript
x-amz-cf-pop: SYD3-P2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 97ms
95ms XHR
application/json 108.158.28.226
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.28.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-28-226.syd3.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 2133
access-control-allow-credentials: true
via: 1.1 d5a7b4f0ce5b27d5b6750a1a5f7fd024.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: SX8h1oRpLrJhtmWivQ2tMjh6mtXCK6PFZKRPNdGb80yxCG1i3WWclw==
date: Sat, 26 Apr 2025 01:14:01 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: SYD3-P2
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 234 B
532 B 654ms
423ms Fetch
application/json 18.65.247.162
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.avasporelight.com%2F&pid=eEUo6FuXJ7Jou&cb=0&ws=1600x1200&v=25.414.1933&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=0163a608-d326-49f6-9117-3d124fb986d4&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.247.162 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-247-162.syd3.r.cloudfront.net
Software: Server /
Resource Hash: c42746409bfbb716901dac757f11942f8873afd952c70da669fe6bb4d5a2735e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 db987b94354bedc3a16788229c0e652c.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 202
x-amz-cf-id: f5HEVCHAK_-Iy1rbwfeBDPo1cF5nxQfbPZa2ti8x1zAD7PPSPqWU0Q==
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: SYD3-P1
server: Server

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 200 KB
65 KB 692ms
323ms Script
application/javascript 2404:6800:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:809::200e Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ae3d0de616352267f53564092b118e5edabf2b1735fef30fb511c1e7982d56dc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3MmKcfcxSS7fGAB_Bj1D9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw05BiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxkXbPxFutWIG7Svs3aBcRCPBzrv284wCbwYn_7MmYljaT8wvjk_LySosyk0pL8orTktNTi1KKy1KJ4IwMjUwMTIxM9A4P4AgMAaLVA5Q"
content-security-policy: script-src 'report-sample' 'nonce-3MmKcfcxSS7fGAB_Bj1D9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame B29B 1 KB
2 KB 280ms
86ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 970
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:33:25 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwrIfA5OwEeUy2cv8dbWzIsubFr1WziRG3jBBU-Kd-b7JfqUNg-RtXAynx4TqkROVKATUI4CKe0

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 9D3C 2 KB
1 KB 292ms
93ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=111970
content-encoding: gzip
content-length: 859
content-type: text/html
date: Sat, 26 Apr 2025 01:49:35 GMT
expires: Sun, 27 Apr 2025 08:55:45 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 422ms
302ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81ee5706ac35d9120078edad3eff4a05b9779ecb1ccec404a29e0cb0de10165d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632175&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=G30qxIkzKx02Wk%2F8FmazK6udTwCVWMfv%2FCW4r%2F9lWrY%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632175&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=G30qxIkzKx02Wk%2F8FmazK6udTwCVWMfv%2FCW4r%2F9lWrY%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 93626ca8d9c2864c-PER
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 124 KB
35 KB 682ms
562ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b290cf3a3316a9c093e9670e6e7eef66e692724f801458e2d35e9df1d1f6beb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632175&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=G30qxIkzKx02Wk%2F8FmazK6udTwCVWMfv%2FCW4r%2F9lWrY%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632175&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=G30qxIkzKx02Wk%2F8FmazK6udTwCVWMfv%2FCW4r%2F9lWrY%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 93626ca8d9c3864c-PER
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
457 B 638ms
330ms Fetch 2406:2600:7:100::2c
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=76226809438&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::2c , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:35 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 316ms
100ms Fetch
application/json 52.76.116.238
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632175353&to=-480&aun=pw-160x600_atf&pubcid=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=70d9f318-9266-4338-999e-9591d47707b9&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.116.238 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-116-238.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 315ms
99ms Fetch
application/json 52.76.116.238
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632175354&to=-480&aun=pw-160x600_btf&pubcid=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=7ad22655-d2d5-47f5-a7bc-4aba10b295ba&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.116.238 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-116-238.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 315ms
99ms Fetch
application/json 52.76.116.238
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632175354&to=-480&aun=leaderboard_atf&pubcid=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=715178f9-de6c-4b3a-a074-f33b0f7861df&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.116.238 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-116-238.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 313ms
98ms Fetch
application/json 52.76.116.238
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632175354&to=-480&aun=leaderboard_btf&pubcid=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=ba2e9d5c-33e8-4a28-845b-461cefc8b9f3&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.116.238 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-116-238.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
853 B 331ms
105ms Fetch
application/json 54.169.90.152
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.169.90.152 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-169-90-152.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-auction-status: 29, 29, 29, 29
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 603ms
186ms Fetch
application/json 15.197.196.10
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.197.196.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ae69789f15ba8a942.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 477 B
2 KB 993ms
365ms Fetch
application/json 103.43.90.54
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.54 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

571304d1f3b54e880cb0f23b1041e1a410b48ec6cc5e6f42750145540f92a371

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.100; 103.108.231.100; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: e23b2daf-218f-4c84-b2ea-58429a7e25c4
content-length: 477
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:49:36 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 145 B
1009 B 477ms
326ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01dc9d973fd1b5c73e0d1433b81543a74dab6aed04506cb54bbed0fd1f2eb055

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93626ca919de8673-PER
expires: 0
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 51 KB
18 KB 387ms
322ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a02a7f00276ba8e3aebbd63c4aa1ffb51c688833c970e971c686e19ab5fa37a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xZffOTNK%2BPoKhXpRQEMFvi4zIZmbuuhGGSrT2xgwM4jhZH4oEunpJS3%2Fn7eK5Xgc0zYSEPcQZ9AuGbQDCoIms7pfEGoo4FRVz6JJCAxU0fTg%2FhPurZYI0YYyNn%2FGXl%2BWF2dgUTAJ"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93626ca8aa60cf9d-PER
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1222ms
545ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:49:36 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1220ms
547ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:49:36 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1319ms
643ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:49:36 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1222ms
537ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:49:36 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
626 B 456ms
252ms Fetch
application/json 18.67.93.113
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-93-113.syd62.r.cloudfront.net
Software: istio-envoy /
Resource Hash: dd5655ec621216a7b731cca399e1b73bdd8420ab722702108d2bf864a3f11d11

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 60a3c74b395afbd3a50d71e59ea19eca.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: XWMGjCWOPinwqnTGIgU8ysPsGdzLiV_WbkY4V6BbmiXgksjlWIq-qA==
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
x-amz-cf-pop: SYD62-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 757 B
795 B 1022ms
376ms Fetch
application/json 52.90.223.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.90.223.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

17ee2e282ab76cbb230cace6c0f2197f27cd430dfc10b267454a26d01626c8a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 439
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 519 B
655 B 1040ms
393ms Fetch
application/json 52.90.223.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.90.223.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

3fc06d05abb305bbd3db94924b5b40bcaa355eea0b3f6b4603369b02ab8d933f

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 299
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 431 B
636 B 992ms
346ms Fetch
application/json 52.90.223.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.90.223.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a08a453a31948bdeccf492893c857eaff87a65ef6c4d935bb0f8ae1906dbdbd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 279
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 826 B
814 B 1290ms
645ms Fetch
application/json 52.90.223.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.90.223.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

945607ee00743490a15d9141ca6424b1d7f6710c17c2a72bc30325beb6346656

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 458
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 1029ms
363ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:49:36 GMT
server: nginx

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 14 KB
7 KB 703ms
355ms Fetch
application/json 2406:2600:7:100::1b
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::1b , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

08f3eb6fa81fd07e66ab7611dbd3ea712e0ade14b606eb5c3551c5a911be3d98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 13 KB
6 KB 459ms
205ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=ab0b6004-470c-4ab2-9eea-5210627e6c6d&l_pb_bid_id=123c809bdbd3ca45&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=70d9f318-9266-4338-999e-9591d47707b9&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.4981402063243565
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: a0343ca074d47418b1effc55b39038d414d3aaeeba7578906bb0a046d3c59647

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 13 KB
6 KB 454ms
201ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=ab0b6004-470c-4ab2-9eea-5210627e6c6d&l_pb_bid_id=124dc3dcc870552a&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=7ad22655-d2d5-47f5-a7bc-4aba10b295ba&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.07306995861360677
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: de90978fe7bf77c00d7f6289202d62e307b417c22e303c2ddf1f988523bad1d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 529 B
1 KB 432ms
179ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=ab0b6004-470c-4ab2-9eea-5210627e6c6d&l_pb_bid_id=1250ac57c3de20e5&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=715178f9-de6c-4b3a-a074-f33b0f7861df&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.6805693819393831
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 47f9e3504e12d03af12f8e2224d5399a97e072fbc43961b40251f2669e3a1592

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 529
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 529 B
883 B 443ms
191ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=ab0b6004-470c-4ab2-9eea-5210627e6c6d&l_pb_bid_id=1264d74eb371861e&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=ba2e9d5c-33e8-4a28-845b-461cefc8b9f3&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.7500044687429395
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 7fd8e6563b687552aae65acf3b3c34ba1b37dc9e5710c83996e2cd28faedde66

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 529
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 369ms
176ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: d4a5e3eace7ff0ebc12dbea300609b0b9c0ccbffd1623be89f40b9367f00f315

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 103.108.231.100
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: text/plain
vary: Origin

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 197ms
191ms Fetch
text/plain 2404:6800:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54n0v9102396898za200zb9101576445&_p=1745632173709&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&cid=1287109666.1745632175&ul=en-au&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745632175&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.avasporelight.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1745632173709&tfd=3434
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54n0v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4006:809::200e Sydney, Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 329ms
95ms Script
application/javascript 23.198.58.119
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/fdwlngjfaxlnamjyjproxjqvnicxsvRSmZYUk9KcDUwZ3hDM1ZWaHRyUmYtMjY5MC0yNjc2NzMwMC0xMDA3MDI3MS0zODM2LVZjM0xWa2NvNW9UY2tqWEdMc05h/4rnw32yifufix0ntsxyddrrnwl7cqq17p/uqhtcf/zadtyjn7u2pa6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.198.58.119 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-198-58-119.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Sat, 26 Apr 2025 02:04:35 GMT
accept-ranges: bytes
content-length: 17407
date: Sat, 26 Apr 2025 01:49:35 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 109ms
104ms Script
text/javascript 108.158.20.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/fdwlngjfaxlnamjyjproxjqvnicxsvRSmZYUk9KcDUwZ3hDM1ZWaHRyUmYtMjY5MC0yNjc2NzMwMC0xMDA3MDI3MS0zODM2LVZjM0xWa2NvNW9UY2tqWEdMc05h/4rnw32yifufix0ntsxyddrrnwl7cqq17p/uqhtcf/zadtyjn7u2pa6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.20.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-20-59.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 38020
via: 1.1 13f78fbcf1cf5a45dca12f9d22e82f46.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: N7sPjKv70hhVkvWS28jHpXqAD1CLkCt45vUiRhhNeFdtcPz5TLUOIg==
date: Fri, 25 Apr 2025 15:15:55 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P3
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
342 B 185ms
72ms Script
application/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&_it=amazon&partner_id=403
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/fdwlngjfaxlnamjyjproxjqvnicxsvRSmZYUk9KcDUwZ3hDM1ZWaHRyUmYtMjY5MC0yNjc2NzMwMC0xMDA3MDI3MS0zODM2LVZjM0xWa2NvNW9UY2tqWEdMc05h/4rnw32yifufix0ntsxyddrrnwl7cqq17p/uqhtcf/zadtyjn7u2pa6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=432000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"ba4f7a703ea78ac1b72b5fe1be4fb407"
age: 3968
cf-ray: 93626ca96b6e87b8-PER
x-amz-request-id: 80DVRQA7C49HCA99
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
last-modified: Thu, 05 Dec 2024 20:48:49 GMT
x-amz-id-2: 7iZI9GWiQGAAZJqZ/9BLV+nOrjIhdaIeDQonP1go/ucMJB2iXOG52XWcxiEvEV9/+lr/KzTKOPw=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 183ms
64ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

007036d465b81110214bfc2593974dfd94e31304794dd2e2f0a85adf880cf472

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: VbCEG4GlQXqvbPUzK5fmIJvFSD2VC4BAzQ+frRYFh4guCCp78Y/0Xcpz/Xcc3nLP7gWueHHdMZw=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"e080505431750bcc4447c43d487f9da4"
age: 779
x-amz-request-id: AQ2RMTERPBQR0KW4
cf-ray: 93626ca97b7187b8-PER
date: Sat, 26 Apr 2025 01:49:35 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 18 Apr 2025 14:04:56 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 326ms
95ms Script
application/javascript 23.198.58.119
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/fdwlngjfaxlnamjyjproxjqvnicxsvRSmZYUk9KcDUwZ3hDM1ZWaHRyUmYtMjY5MC0yNjc2NzMwMC0xMDA3MDI3MS0zODM2LVZjM0xWa2NvNW9UY2tqWEdMc05h/4rnw32yifufix0ntsxyddrrnwl7cqq17p/uqhtcf/zadtyjn7u2pa6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.198.58.119 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-198-58-119.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Sat, 26 Apr 2025 02:04:35 GMT
accept-ranges: bytes
content-length: 5252
date: Sat, 26 Apr 2025 01:49:35 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 736ms
236ms XHR
application/octet-stream 35.162.56.239
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.162.56.239 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-162-56-239.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1745632175546&did=did-0046&se=e30&duid=8e413bd09c43--01jsqwj8y3pwpyq8ybmr1r2eq2&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.avasp...
https://rp4.liadm.com/j?dtstmp=1745632175546&did=did-0046&se=e30&duid=8e413bd09c43--01jsqwj8y3pwpyq8ybmr1r2eq2&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.avas...

13 B
369 B

1119ms
306ms

Fetch
application/json

3.217.148.145
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1745632175546&did=did-0046&se=e30&duid=8e413bd09c43--01jsqwj8y3pwpyq8ybmr1r2eq2&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.avasporelight.com%2F&cd=.paint.toys&i6=MjQwNDpmNzgwOjg6ZGVlOjoyZQ%3D%3D&n3pc=true
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.217.148.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-217-148-145.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 0ab216b5-a990-4d55-a1af-d8abc42d7463
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1745632175546&did=did-0046&se=e30&duid=8e413bd09c43--01jsqwj8y3pwpyq8ybmr1r2eq2&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.avasporelight.com%2F&cd=.paint.toys&i6=MjQwNDpmNzgwOjg6ZGVlOjoyZQ%3D%3D&n3pc=true
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 26 Apr 2025 01:49:36 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MkJwSWVyTmxmUWR2Wkt0OTBreUF4YXozSXp5TWUwdzhBSy15c05ub2wxcDQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MkJwSWVyTmxmUWR2Wkt0OTBreUF4YXozSXp5TWUwdzhBSy15c05ub2wxcDQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEF7Qsy-cVaup8u5AdVgVbCs&google_cver=1

70 B
440 B

95ms
95ms

Image
image/gif

54.153.211.209
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEF7Qsy-cVaup8u5AdVgVbCs&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.153.211.209 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-153-211-209.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:49:36 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEF7Qsy-cVaup8u5AdVgVbCs&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Sat, 26 Apr 2025 01:49:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=5be5cdc9-7606-42b2-a843-8f71bb977d32&bid=1e2n4ou

70 B
440 B

97ms
94ms

Image
image/gif

54.153.211.209
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5be5cdc9-7606-42b2-a843-8f71bb977d32&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.153.211.209 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-153-211-209.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:49:35 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=5be5cdc9-7606-42b2-a843-8f71bb977d32&bid=1e2n4ou
content-length: 191
date: Sat, 26 Apr 2025 01:49:35 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=1879256767580541313&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

99ms
98ms

Image
image/gif

54.153.211.209
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=1879256767580541313&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.153.211.209 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-153-211-209.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:49:36 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=1879256767580541313&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.100; 103.108.231.100; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 3b8307ab-b98e-4485-b7fe-69fde2625035
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:49:36 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=eyeota
https://ps.eyeota.net/match?bid=tpm4omv&uid=Ai_vkLg-XRdMzuQM5jZW7Gds52Q&gdpr=&gdpr_consent=

70 B
440 B

96ms
95ms

Image
image/gif

54.153.211.209
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=tpm4omv&uid=Ai_vkLg-XRdMzuQM5jZW7Gds52Q&gdpr=&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.153.211.209 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-153-211-209.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:49:36 GMT
Content-Type: image/gif

Redirect headers

Location: https://ps.eyeota.net/match?bid=tpm4omv&uid=Ai_vkLg-XRdMzuQM5jZW7Gds52Q&gdpr=&gdpr_consent=
Content-Length: 126
Date: Sat, 26 Apr 2025 01:49:36 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-o9v0bhFE2pX1RhWKCtL.CW36xHXivPRWvmQ-~A&gdpr=0

70 B
440 B

95ms
94ms

Image
image/gif

54.153.211.209
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-o9v0bhFE2pX1RhWKCtL.CW36xHXivPRWvmQ-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.153.211.209 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-153-211-209.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:49:36 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-o9v0bhFE2pX1RhWKCtL.CW36xHXivPRWvmQ-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: text/html
server: ATS

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame D209 0
100 B 297ms
95ms Document
text/plain 52.76.116.238
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.116.238 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-116-238.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Sat, 26 Apr 2025 01:49:36 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 96ms
95ms Script
application/javascript 23.198.58.119
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.198.58.119 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-198-58-119.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Sat, 26 Apr 2025 02:04:35 GMT
accept-ranges: bytes
content-length: 17042
date: Sat, 26 Apr 2025 01:49:35 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame AAAA
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbr...

393 B
1 KB

331ms
330ms

Document
text/html

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Server /

Resource Hash

8b943a943269be38667cb762d7b49a6c070271afebe1d4e0c359d9a5523ac6c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 393
Content-Type: text/html;charset=ISO-8859-1
Date: Sat, 26 Apr 2025 01:49:37 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 3A37063T3V2XDRXYNN47

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Sat, 26 Apr 2025 01:49:36 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: WM5N8BFJ2E9ZVG8RYT4J

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 350ms
98ms XHR
application/json 2406:da18:a99:1b02:bd8d:f79f:23a1:e894
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2406:da18:a99:1b02:bd8d:f79f:23a1:e894 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Sat, 26 Apr 2025 02:19:36 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/json
vary: origin
server: nginx

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 564ms
94ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 26 Apr 2025 01:49:35 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 217437
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H3 200 2f9fdaebdd99f71aaf1c26ec879999a33cdfd09213aae9f4ff1f2097f172975dfc Show response
faucetfoot.com/submit/ 299 B
323 B 496ms
233ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/submit/2f9fdaebdd99f71aaf1c26ec879999a33cdfd09213aae9f4ff1f2097f172975dfc

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/static/3160c21523d58/ca6bde09737649d_4398cbb3d2db528f5cbb.v1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

c4bad7c57363a287974e70654bf2f5687c23c3041ea07c2c54a340bf04665566

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-asia-east1-p67b.gce-asia-east1, 1.1 google
expires: Sat, 26 Apr 2025 01:49:35 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame AE8E 4 KB
5 KB 1016ms
326ms Document
text/html 64.227.19.223
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.227.19.223 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: c5ba2877711a20d065d9dac1294c358ccbff3109ee843e40a62b635426935239

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4167
content-type: text/html
date: Sat, 26 Apr 2025 01:49:36 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
293 B 1059ms
347ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

dc7584ba99cc71fc2b5a6e835b1ee48e7f0b105d031580608fcfb3d9fc66f8d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 AGSKWxWD_Rb8Sh1KnlbfG1FPODjh60a1YDq0eFyz2vHlk5NMkTbohQSRcHuOsfbBBuXqyCWM1DEI6am2m-md-glnvTBZTsV0Aoa-IGyPqvdoNJH5ikUXrnsJdUWwOuc84C2LqZxHOgu_Qw== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 223ms
219ms Script
application/javascript 2404:6800:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWD_Rb8Sh1KnlbfG1FPODjh60a1YDq0eFyz2vHlk5NMkTbohQSRcHuOsfbBBuXqyCWM1DEI6am2m-md-glnvTBZTsV0Aoa-IGyPqvdoNJH5ikUXrnsJdUWwOuc84C2LqZxHOgu_Qw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjMyMTc2LDIyMDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJpQ1hMZFVyOW4wVSJdLFs5LCJlbi1HQiJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmF2YXNwb3JlbGlnaHQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.iCXLdUr9n0U.es5.O/d=1/rs=AJlcJMzPTmkBD-KCCRv7uazEGh6aCSpsCw/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:809::200e Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

77d86783e8bd05eed95fd457a0d4d73f9c1299e6ae1627616e17c7a0f2ce196c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-lvACAZEv4bOKCmGMobtGMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmII1pBiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIY9NusqYCce_em6w3jtxk3bXxFuthIG7Svs3aBcRCPBwbvm84wCZwYG77CkYljaT8wvjk_LySosyk0pL8orTktNTi1KKy1KJ4IwMjUwMTIxM9A4P4AgMAZgRAvQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-lvACAZEv4bOKCmGMobtGMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame DC70 101 KB
28 KB 289ms
96ms Document
text/html 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

190f676ee781e35d2d2a8c07e56b2ca05fe36625bbc7a5cfec2f3a060a45c3e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 167
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28980
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:46:49 GMT
expires: Sat, 26 Apr 2025 02:36:49 GMT
last-modified: Mon, 21 Apr 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 542ms
106ms Script
application/javascript 2600:9000:277c:ee00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:277c:ee00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 402
x-cache: Hit from cloudfront
x-amz-cf-id: 1QZacjTlEuB46kg881he85qhEu2bxwXK5L5zbO2ZiYnRkvpqQfiAlA==
date: Sat, 26 Apr 2025 01:42:55 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 8902bdfd4bf51d2d735e85d0656d36ae.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: SYD3-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 272ms
86ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 740465
x-goog-stored-content-encoding: gzip
expires: Fri, 17 Apr 2026 12:08:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Thu, 17 Apr 2025 12:08:31 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyItuiTJUAjpeN06vSfA7Awn4-wEJEko2guslXTTobCAs1ApamZJh0gA4Bg9rWcGvYIW0
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 584ms
402ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 606f36f65b78dcbe10e93b66a3e22be9

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 202ms
54ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 27521
cf-ray: 93626cae8a31709e-PER
expires: Tue, 29 Apr 2025 01:49:36 GMT
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 553ms
144ms Script
text/javascript 2406:2600:7:100::2d
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::2d , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Sun, 27 Apr 2025 01:49:36 GMT
access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 357ms
356ms Fetch
text/plain 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
292 B 1279ms
348ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

dc7584ba99cc71fc2b5a6e835b1ee48e7f0b105d031580608fcfb3d9fc66f8d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 942ms
305ms XHR
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 944ms
307ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 95ms
95ms Script
application/javascript 23.198.58.119
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.198.58.119 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-198-58-119.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Sat, 26 Apr 2025 02:04:36 GMT
accept-ranges: bytes
content-length: 67550
date: Sat, 26 Apr 2025 01:49:36 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 AGSKWxW_bPggid4N5q3PF3ZeIrQQNSwPOX8qSAj1AXrJA8DGHlNqZm1Oppn1EjbTHzJ_K1fAYRqB0NufP1w_CP-BW48t2tUoHOt7hvlKXrm9lhYheqYdJLE_XMBLHgtNzFPMPQOcdILqfg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 221ms
220ms Script
application/javascript 142.251.221.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW_bPggid4N5q3PF3ZeIrQQNSwPOX8qSAj1AXrJA8DGHlNqZm1Oppn1EjbTHzJ_K1fAYRqB0NufP1w_CP-BW48t2tUoHOt7hvlKXrm9lhYheqYdJLE_XMBLHgtNzFPMPQOcdILqfg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjMyMTc2LDQ1NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiaUNYTGRVcjluMFUiXSxbOSwiZW4tR0IiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXd4ei5hdmFzcG9yZWxpZ2h0LmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab35b24a7c8f455c536b248fd9ef640d2a8011f797c2fa0a7fe49502faeb9328

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-6NUGqRg0wSxds5kmey-l_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmLw1JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GTdtfEW62EgbtK-zdoFxEI8HBu-bzjAJnChf8dEJiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxMjEz0Dg_gCAwCRczvA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-6NUGqRg0wSxds5kmey-l_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
3 KB 617ms
617ms Fetch
text/plain 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6315365604801561&correlator=3836767676632448&eid=83321073&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745632176782&lmt=1745632176&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDY3M2EzZjhkLTFiNmItNDkyNy1hOWY1LTVkMjBiYjc1MmFiMFgBEh0KDmVzcC5jcml0ZW8uY29tGOfQpP7mMkgAUgIIZBIYCgl5YWhvby5jb20Y5tCk_uYySABSAghkEhQKBW9wZW54GKTTpP7mMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Y59Ck_uYySABSAghkEhcKCHJ0YmhvdXNlGOfQpP7mMkgAUgIIZBJTCg1jcndkY250cmwubmV0EkAxZTE2NjhhZjIyY2E3ZjRmYTg0NTFhMTA3YjM4MTg1Y2EwMmNmYzZiYTUzOWVlODZmNWMxMjI1YzhlNjkwOTc4WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745632173690&idt=1574&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D67c55f738e744ca19c762eb646beeabe32175279%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_format_s2s_median%3Dbanner%26hb_size_s2s_medianet%3D160x600%26hb_pb_s2s_medianet%3D0.10%26hb_adid_s2s_medianet%3D144922fe3c67ff97%26hb_bidder_s2s_median%3Ds2s_medianet%26hb_format_s2s_triple%3Dbanner%26hb_size_s2s_tripleli%3D160x600%26hb_pb_s2s_triplelift%3D0.24%26hb_adid_s2s_tripleli%3D143b3a5f8662f5778%26hb_bidder_s2s_triple%3Ds2s_triplelift%26hb_format_grid%3Dbanner%26hb_size_grid%3D160x600%26hb_pb_grid%3D0.45%26hb_adid_grid%3D140cc9815da5bab68%26hb_bidder_grid%3Dgrid%26hb_format_rubicon%3Dbanner%26hb_size_rubicon%3D160x600%26hb_pb_rubicon%3D0.48%26hb_adid_rubicon%3D13891fc157e82c92%26hb_bidder_rubicon%3Drubicon%26hb_cache_host_s2s_ix%3Dprebid.adnxs.com%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.64%26hb_adid_s2s_ix%3D142c2b5dfbd1e6ff8%26hb_bidder_s2s_ix%3Ds2s_ix%26hb_format_ix%3Dbanner%26hb_size_ix%3D160x600%26hb_pb_ix%3D0.93%26hb_adid_ix%3D1358f7749f66edfb8%26hb_bidder_ix%3Dix%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.93%26hb_adid%3D1358f7749f66edfb8%26hb_bidder%3Dix%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.avasporelight.com%252F%26tyche_code%3DV.20250423.1%26pageos_code%3DV.20250423.1%26config_id%3D1024872_74068_primary_config%26hour%3D9%26day%3DSaturday%26referrer_domain%3Dqwxz.avasporelight.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250423.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%252C66%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=19782&tan=ec4b549b-a0ad-4d21-bdc9-5ac7f3f364d7&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec6e95b2a9f1dbf47bce11faf49df3dcad93c1b7cb80e462a4b2803f1548016d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 6333148468
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138436054483
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 3096
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
abdba2f0e3e00e636c3c30f552be9660.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 65FF 7 KB
3 KB 604ms
194ms Document
text/html 2404:6800:4006:810::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://abdba2f0e3e00e636c3c30f552be9660.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:810::2001 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: Sat, 26 Apr 2025 01:49:37 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
529 B 577ms
387ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 9696f55d315df9c49ba29e67bb6fd988f3523dd3a3830edc17235dd738a03b71

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json
x-cloud-trace-context: ce0bd3aba82329c40260f0a4276c280e
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 7521 16 KB
6 KB 431ms
141ms Document
text/html 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

43fe7cc6db1c3739aeb83e2496de0dd49feaf3aeee148bbb99f2aabd682f9347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:49:36 GMT
server: Kestrel
server-processing-duration-in-ticks: 846556
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 3B7A
Redirect Chain

https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db...
https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db...

1 KB
2 KB

181ms
179ms

Document
text/html

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: 8bd61a8c18c2c35ce146a622010954bd012f3b7bb9a659be42e3cd370f29972b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1235
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
location: /sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 setuid
prebid.intergient.com/ Frame AE8E 0
840 B 351ms
296ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=4fd55784-f9d7-6a7e-3221-6ef6f9b7da47
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632177&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=qVJVzojOHq1Sd77jTu5csVPWSB8NB%2F%2BWTxjoo%2F2R2SE%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632177&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=qVJVzojOHq1Sd77jTu5csVPWSB8NB%2F%2BWTxjoo%2F2R2SE%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93626cb39c8a7384-PER
server: cloudflare

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=1879256767580541313&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

315ms
188ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E 43 B
183 B 577ms
187ms Image
image/gif 35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame AE8E
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=&gdpr=&gdpr_consent=
https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&zcc=1&cb=1745632178199
https://ad.turn.com/r/cs?pid=45&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004&rndcb=7858157042
https://sync.1rx.io/usersync/turn/4130458107486119565?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-2a5c99f9-d76c-477a-b776-ea00...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004

43 B
479 B

313ms
311ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: GZHQ99SBKEB1S3ZQHJFF
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:40 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Sat, 26 Apr 2025 01:49:40 GMT
etag: RX2a5c99f9d76c477ab776ea00e998a052004
content-type: text/html

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privac...
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=4644569080041589825138&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

293ms
188ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KjutALZHoTa57tVPSm2t2Acz&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

365ms
182ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%26gd...
https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%26gd...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NEUzMjcxMDctNDdGOC00NDNBLUFFNUQtQUY5ODk5RkQwNjMw&gdpr=-1&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=-1&gdpr_consent=&piggybackCookie=CAESEEgmoNxq1DPk54dlElYlaJA&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

407ms
187ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=2ea5ca41-c19e-425d-b433-5a4b050e541e
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

191ms
188ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=&userId=ID5-5-3e246b10-e1bd-4d95-bdd0-6478c43cf68b
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

533ms
187ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=da93f03aa5834a283b2947d5b64fbc16&_fw_gdpr=&_fw_gdpr_consent=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

298ms
191ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr_con...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3886337779037219000V10&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

444ms
195ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H/1.1 200
OK sync.html
sync.clearnview.com/ Frame AE8E 730 B
730 B 1150ms
334ms Image
text/html 204.62.12.186
NATCOWEB

General

Check archive.org

Download Go to Show image

Full URL: https://sync.clearnview.com/sync.html?gdpr=&gdpr_consent=&usp_consent=&pubid=17&pubuid=4fd55784-f9d7-6a7e-3221-6ef6f9b7da47&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dbrave%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D$UID
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.62.12.186 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

Transfer-Encoding: chunked
Access-Control-Allow-Origin: https://sync.cootlogix.com
Keep-Alive: timeout=5
Date: Sat, 26 Apr 2025 01:49:38 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame AE8E
Redirect Chain

https://ads.yieldmo.com/pbsync?is=vidazoo&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dyieldmo%26gdpr%3D%26gdpr_consent%3D%26us_privacy%...
https://sync.cootlogix.com/api/cookie?partnerId=yieldmo&userId=xcwe93SXwnSXvtzXkb1C&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

333ms
188ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame F518
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

353ms
115ms

Document
text/html

184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 642A 199 B
425 B 395ms
174ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Sat, 26 Apr 2025 01:49:36 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.100

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 1014 199 B
843 B 501ms
237ms Document
text/html 2600:9000:2774:ae00:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fuser%3FpartnerId%3Dminutemedia%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BpartnerId%7D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2774:ae00:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: b53194d64503b568738ae7aafdc7d8d83a305afb5db0842fb1313c5f8de7e403

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://sync.cootlogix.com/
access-control-expose-headers: X-Reason
content-length: 199
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
server: istio-envoy
via: 1.1 3e4f9c0400441c93ce3468dd26ef9ee4.cloudfront.net (CloudFront)
x-amz-cf-id: T0rN2NqyJm1N2tVJZrclLd_HySMy1I-akV1UPMUEvh333CxHhio4Ng==
x-amz-cf-pop: SYD62-P3
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 1

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 819 B
1 KB 347ms
346ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

0d9c8d935660bf8b9ce4752d39b8589b46b9a0b9f2f555f985eb70b06b998721

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json
vary: Origin

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
705 B 329ms
309ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 6c986d3a9ab3eb268f506213ccb52b909b03293bab5d4b33d6816c736c1b40f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 328ms
308ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 328ms
308ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 328ms
309ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame CACE 3 KB
4 KB 310ms
309ms Document
text/html 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

2dfdf018d618637ea025c0d60c5d187f39fd8ef5f6df94bdee83a991b13b44ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 3536
Content-Type: text/html;charset=ISO-8859-1
Date: Sat, 26 Apr 2025 01:49:37 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: C60B5GYJBY899CE8DNZF

GET
H3 200 _300.htm=adshow& Show response
fundingchoicesmessages.google.com/f/AGSKWxVEIAbyjtUrqFjsqcIQWi2yfocYL5ZRj61c7WfzhLArwy4pUtA2SOZDukeXz4zWJ0VBj32xKTMsLdvwlbeKuMXMNL_vZao2pe7cw1GgEHKVarvmC4D9OO97FaOcFSVidiC3tTThkwDKhUJ1GQmpM-9khMbAX... 54 B
109 B 200ms
199ms Script
application/javascript 142.251.221.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVEIAbyjtUrqFjsqcIQWi2yfocYL5ZRj61c7WfzhLArwy4pUtA2SOZDukeXz4zWJ0VBj32xKTMsLdvwlbeKuMXMNL_vZao2pe7cw1GgEHKVarvmC4D9OO97FaOcFSVidiC3tTThkwDKhUJ1GQmpM-9khMbAXzaK0SEgG2t-q4nqc9lpp6Frq3ZXJh5E/_/serveads./tops.ads..es/ads/_300.htm=adshow&

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.iCXLdUr9n0U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMzPTmkBD-KCCRv7uazEGh6aCSpsCw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

702e3b4530ce22fbea31d5e821614b8bb7256d298912c86e67431e525e1d7102

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-pOi3lWzowC7fb960M2-KZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw15BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GRds_EW61YgbtK-zdoFxEI8HBu_bzjAJtCxf90LRiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxMjEz0Dg_gCAwCRVzvX"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-pOi3lWzowC7fb960M2-KZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 61 B
76 B 297ms
98ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.iCXLdUr9n0U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMzPTmkBD-KCCRv7uazEGh6aCSpsCw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16023549773543154165
age: 874
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 02:35:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 01:35:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 51
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUY2dvzMKCJlJ5wVmuOO0ZCujncLy0WRDHZVG37lF22cYD9laMtrEDuMDTST-yUwQ0QTXJAUzqLgMnw7NIojk-jHwhYSCaDeD21ENdoC1q69UBKCgFTwh3w96s407godnddLTyAFw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 400ms
205ms XHR
text/html 142.251.221.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUY2dvzMKCJlJ5wVmuOO0ZCujncLy0WRDHZVG37lF22cYD9laMtrEDuMDTST-yUwQ0QTXJAUzqLgMnw7NIojk-jHwhYSCaDeD21ENdoC1q69UBKCgFTwh3w96s407godnddLTyAFw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-w449mcpeh0i3Do_Uk9OfdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII0JBi-FB_mfUHEAvxcGz8vuEAm8CPqzOPMim5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTIxM9A7P4AgMAm-olMQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-w449mcpeh0i3Do_Uk9OfdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

sid Show response
mug.criteo.com/ Frame 7521
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=3&topUrl=paint.toys&bundle=N_au6F9WMnJuMmxtOHlVNVlHeWNvbEN4ck9vZjR0ekVKWG9vUzU5dE05JTJCJTJGZTAzZWhVdWl...
https://mug.criteo.com/sid?cpp=hAMLo3xkVStXVVhsaGdEL01TdXdiVk1aT0RkRmlBYlUzVWpOeW9CUUdWSmJxQUhDZmZHS3VHaGl0VXNkOE9zM01LaHZaZkVHeE04SzA0OSs1Uk5vK2NyMjFWYXNhbWsvU1BlR3BrQ2U5UHEzZ3plc0tYMXBKZDNYdFBrTX...

430 B
1006 B

434ms
139ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=hAMLo3xkVStXVVhsaGdEL01TdXdiVk1aT0RkRmlBYlUzVWpOeW9CUUdWSmJxQUhDZmZHS3VHaGl0VXNkOE9zM01LaHZaZkVHeE04SzA0OSs1Uk5vK2NyMjFWYXNhbWsvU1BlR3BrQ2U5UHEzZ3plc0tYMXBKZDNYdFBrTXRYWi9YeHdJOVpiTzQvbEx1MVFPdU1sWU9UcXBjSVM1OE1BMGd2WXgyS1lZVXRFY1FEdVRSTElzV0xobTEzNFpzNFh3N3lZRlI3TlIyUWd1VVBwaGdvSmZBU3E3R05xL2dVeDYzSFdwclhGNHgyOTRaR2k2dEJiamExRFY1R2lyNllVeG9KMGVzc3VpbDJ0MWtxelRGdFhCdWhiQnEzWDFVc1lvZGJuVDVBei9mcWIwU2E5V0dGNFF0VWlVK3lia05OTzJSV1BIYXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

93508b0f9ae74f5e43cab1cb299ecde28c4b940cb23e443f518e8bfe1d1a03b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 778714
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=hAMLo3xkVStXVVhsaGdEL01TdXdiVk1aT0RkRmlBYlUzVWpOeW9CUUdWSmJxQUhDZmZHS3VHaGl0VXNkOE9zM01LaHZaZkVHeE04SzA0OSs1Uk5vK2NyMjFWYXNhbWsvU1BlR3BrQ2U5UHEzZ3plc0tYMXBKZDNYdFBrTXRYWi9YeHdJOVpiTzQvbEx1MVFPdU1sWU9UcXBjSVM1OE1BMGd2WXgyS1lZVXRFY1FEdVRSTElzV0xobTEzNFpzNFh3N3lZRlI3TlIyUWd1VVBwaGdvSmZBU3E3R05xL2dVeDYzSFdwclhGNHgyOTRaR2k2dEJiamExRFY1R2lyNllVeG9KMGVzc3VpbDJ0MWtxelRGdFhCdWhiQnEzWDFVc1lvZGJuVDVBei9mcWIwU2E5V0dGNFF0VWlVK3lia05OTzJSV1BIYXw&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 357983
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:49:36 GMT
server: Kestrel

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 26D1 0
0 203ms
203ms Fetch
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvL8Mutrw9-cyOmGGPp6fHwGxLMaco93KAGWr2WKzTFYKnAP0kGSCfspqttSqh8U5ROgRukHsZ1sVfl0VEafidrFvPHVtD3Kw8NZSlgL4U-3QmJKqcsNrJlxh81kapwu3ROf5JVfbzXKiD0pPhVmqs9I-pqNnLlqHFY7QF3d8VBN5bTfX3-jRiRA6qZlYLX63ZdsekpWLc_F9zrLpr2msRl4MjPyoUcVfskGQmi194NxSKAaA7v4XTQyCbF_QKzVSz2IPcZMgn_y6KEuNe9Du8R7Mb3NOoYg-_2cZ-cykwfPUFdxMtHHT-torcfyHYcqL3aP2gd4cj8sc7PsOOsL5VznWsSEKLNNreV_O5xqx2tYmjduNiKQu-Aw70auS8R5vkmPWfl0aNq9XALOviqj6Si2iLH5OrFmHa7GP4DD6GWfRIn2w1eSNWg14KgVYNGr0Bpn3r_FJ8ilLOKQRD8IN7fI9QJo8G7tU-5xpHhqYLBcmej5_q20OvCo9kP6qnvfq8cHAYDeouaFI_zS_oV86HF9-gctZD-nqryYl7Qbecn16RKO2MFeSfMwoeXMyjsuNzpUlRK5NiR-fyi61W7E-pSrVsqyQ&sai=AMfl-YQ_3Z9qDmec-fDIB_7ZpNU1U1vBlzUqjFdjVfhLEJGtHLgE3f6wjbXN8pQBcGElT1NaFu_6SkzeFctz3Mkg4b1lO28wo1bNAbV9KWsBKy06MxLNEyjjGRzKA1Ki&sig=Cg0ArKJSzNQRf4fElyLqEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 71D0 663 B
254 B 402ms
201ms Document
text/html 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxD0x1UY6Lr_vgEwAQ&v=APEucNXiPB-b3F1SLS7FBVicUKJM4mVSGDaXecbGx7v5Up7XApxbt2rU6pG4B11ADYsERXxELI1m7rw1JpB3ZHRBVGPfPGz7EQ

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

962d6dea088b031cd44d33f937adb5ba241a9435aa32a8be667d57482b8bbe1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 26D1 110 KB
37 KB 366ms
257ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 18146946010209014275
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 01:49:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38116
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK 72cb1a4c-445e-4ee6-9333-42b92cadc8d0
a5340.casalemedia.com/impression/v2/1031634/85/d063nbtvlt8q58ujc09g/ Frame 26D1 43 B
303 B 816ms
275ms Image
image/gif 139.5.86.150
CASALE-MEDIA

General

Check archive.org

Download Go to Show image

Full URL: https://a5340.casalemedia.com/impression/v2/1031634/85/d063nbtvlt8q58ujc09g/72cb1a4c-445e-4ee6-9333-42b92cadc8d0?verifieD=1&userID=&cmpro=0&deviceType=2&expiryTime=1745632775&profileIDs=&creativeID=c08547&pubID=186266&format=banner&channel=site&ee=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 139.5.86.150 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Expires: 0
Access-Control-Allow-Origin: *
Content-Length: 43
Keep-Alive: timeout=1, max=500
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Server: Apache

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26D1 42 B
63 B 366ms
258ms Image
image/gif 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AEV90jCbmpO7Tu_02gdFLLh6J56C7_lCsReDEbgN8wYOWZ4ucPV8Glan4u5Yu4v71Z95eCb6nfC4p_fVmUF9pYsIsGFtnurWYWyIdA6GhzUCZTUPg

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Apr 2025 01:49:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 26D1 220 KB
68 KB 208ms
100ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a798986e0dce849145906cae97bf77a273b5ffb8880fc0f7da14eff4a9b85aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4151480097505160345
age: 2748
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 02:03:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 01:03:49 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69290
x-xss-protection: 0
server: cafe

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3458 20 KB
7 KB 94ms
93ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=45199
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: Sat, 26 Apr 2025 14:22:56 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame F529 269 B
379 B 335ms
115ms Document
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 7B0A 16 KB
6 KB 160ms
159ms Document
text/html 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

43fe7cc6db1c3739aeb83e2496de0dd49feaf3aeee148bbb99f2aabd682f9347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:49:36 GMT
server: Kestrel
server-processing-duration-in-ticks: 1700925
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 9061 52 KB
17 KB 323ms
107ms Document
text/html 125.56.205.169
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 125.56.205.169 Sydney, Australia, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a125-56-205-169.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sat, 26 Apr 2025 01:49:37 GMT
ETag: "623de86a-cf34"
Expires: Sun, 27 Apr 2025 01:49:39 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 5EB1
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
2 KB

180ms
180ms

Document
text/html

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: cb9de48eeb418c88c8402953957362bfaeef6a503ba4807c2cff0250f294eeec

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
location: /sync?&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 2999 0
0 326ms
325ms Document
text/plain 64.227.19.223
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.227.19.223 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 7310 3 KB
2 KB 166ms
59ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 893
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 93626cb649948673-PER
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: Sat, 26 Apr 2025 05:49:37 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2

200

pd Show response
playwire-d.openx.net/w/1.0/ Frame EBE2
Redirect Chain

https://playwire-d.openx.net/w/1.0/pd
https://playwire-d.openx.net/w/1.0/pd?cc=1

664 B
882 B

171ms
170ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de2110cfd68fbbe6af1aa8a5c44451f4ef9c582cd7daf0635ae24273bdd140a3

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 664
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.100

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Sat, 26 Apr 2025 01:49:37 GMT
location: https://playwire-d.openx.net/w/1.0/pd?cc=1
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.100

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame 439A 11 KB
5 KB 397ms
293ms Document
text/html 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632175853&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df8663fd58edf1debc452007818acea8d2c312b29a34d974f4107fbedcc94fec

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93626cb64aa98671-PER
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: 0
last-modified: Tue, 22 Apr 2025 07:39:39 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 144ms
140ms Preflight
application/json 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=N_au6F9WMnJuMmxtOHlVNVlHeWNvbEN4ck9vZjR0ekVKWG9vUzU5dE05JTJCJTJGZTAzZWhVdWlNVyUyRnlta3hEM1hjJTJGZXFiQUNlQlVKa2VzMGloaEg0N2l2VFJ3VXIzSWNnbUpkcENONVo0b20xT0V3TXRPNHRuaDFvVU1ta2VsNmoyY1ROeldQ&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 26 Apr 2025 01:49:36 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 287752
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 348ms
347ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
661 B 240ms
240ms Fetch
application/javascript 44.239.95.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.239.95.117 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-95-117.us-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 825f2a27dd34659ef73e417d282cf9f79fcbcd99cee6a9555f7bd2b19b65c8fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 241ms
236ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&tp=bhSbf2UtQmFa2YgukkUhY2zDZw3He1g31b7l2hdOlVA%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 0f699547b376604a899f47a0135f7a7989877dd2cd1b66bdd4384e84e0e6d2d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
0 3ms
3ms Fetch 52.203.223.119
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jsqwj8y3pwpyq8ybmr1r2eq2&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.223.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-223-119.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=3599, private
trace-id: cd56447b73efa8f9
request-time: 1
access-control-allow-credentials: true
expires: Sat, 26 Apr 2025 02:49:35 GMT
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:35 GMT
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=N_au6F9WMnJuMmxtOHlVNVlHeWNvbEN4ck9vZjR0ekVKWG9vUzU5dE05JTJCJTJGZTAzZWhVdWlNVyUyRnlta3hEM1h...
https://mug.criteo.com/sid?cpp=B-K4f3xiQk9tbWI5MGYwc1FIdDIwV2ZCblcyWVZXUURZdmlKN2NET3MyTTQwakZYdFViM3p4ditQSlNQOHBmcHJUcm55T0YrdytwU0YwUXp4Qm4xRkVJOW15TVNMc2diS1ZYMmNKb1lNVUtxSysvVlJPLzNYMG1KYWw2NT...

421 B
1 KB

102ms
96ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=B-K4f3xiQk9tbWI5MGYwc1FIdDIwV2ZCblcyWVZXUURZdmlKN2NET3MyTTQwakZYdFViM3p4ditQSlNQOHBmcHJUcm55T0YrdytwU0YwUXp4Qm4xRkVJOW15TVNMc2diS1ZYMmNKb1lNVUtxSysvVlJPLzNYMG1KYWw2NTFFL2F5SXpES0xLQkNNb08xVGVET3lXOTN1SGhYMTJKZEUyeDFwQnJlUTY5OGN6S1VUVDdPelQ0V0EwVk55WlUreU14eTE4VEcwKzg5U3NmY0dCeVY1VVFDV1BEUUFwNVAxRUEwVy9OUlpNMk8xQjM2VFFvRXg5c1c1Yys5MjBJY1VrbDluQ2UrZ3dTd0huaHU0c3BmRWI5Z2FWRmhZa0VYYncxVEt2NnltV00yQUtEaFIvU1QzSUdLZFNPaTE0UzU2OXAwREhEK3w&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

0d86daf62fa79502780a8d7ffdf1a939d01c01603762892216739b27c6a9d1c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 899271
expires: 0
access-control-allow-origin: null
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=B-K4f3xiQk9tbWI5MGYwc1FIdDIwV2ZCblcyWVZXUURZdmlKN2NET3MyTTQwakZYdFViM3p4ditQSlNQOHBmcHJUcm55T0YrdytwU0YwUXp4Qm4xRkVJOW15TVNMc2diS1ZYMmNKb1lNVUtxSysvVlJPLzNYMG1KYWw2NTFFL2F5SXpES0xLQkNNb08xVGVET3lXOTN1SGhYMTJKZEUyeDFwQnJlUTY5OGN6S1VUVDdPelQ0V0EwVk55WlUreU14eTE4VEcwKzg5U3NmY0dCeVY1VVFDV1BEUUFwNVAxRUEwVy9OUlpNMk8xQjM2VFFvRXg5c1c1Yys5MjBJY1VrbDluQ2UrZ3dTd0huaHU0c3BmRWI5Z2FWRmhZa0VYYncxVEt2NnltV00yQUtEaFIvU1QzSUdLZFNPaTE0UzU2OXAwREhEK3w&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 350517
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
server: Kestrel

GET
H2

200

redir
rtb-csync.smartadserver.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFGUUFrN1FHSGNBQUJzZFpvUm5KUQ&gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Csas%2Cshr&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Csas%2Cshr&bee_sync_current_partner=adx&bee_sync_initiator=shr&bee_sync_hop_count=1
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAFQAk7QGHcAABsdZoRnJQ&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csas%2Cshr&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
https://bh.contextweb.com/bh/rtset?ev=AAFQAk7QGHcAABsdZoRnJQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cshr%26bee_sync_current_partner%3Dpp%...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cshr&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AAFQAk7QGHcAABsdZoRnJQ&pid=558502&do=add&gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAFQAk7QGHcAABsdZoRnJQ&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dshr%26bee_sync_...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=shr&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=5829103733374201334&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=vyXkw8rSq3j4JmKvTgxR3x1c&source_user_id=AAFQAk7QGHcAABsdZoRnJQ&gdpr=0
https://match.prod.bidr.io/cookie-sync/sas?gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAFQAk7QGHcAABsdZoRnJQ&partnerid=127&gdpr=0

43 B
334 B

98ms
97ms

Image
image/gif

23.106.127.56
LEASEWEB-APAC-SIN...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AAFQAk7QGHcAABsdZoRnJQ&partnerid=127&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.106.127.56 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sat, 26 Apr 2025 01:49:41 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://rtb-csync.smartadserver.com/redir?partneruserid=AAFQAk7QGHcAABsdZoRnJQ&partnerid=127&gdpr=0
Content-Length: 0
Date: Sat, 26 Apr 2025 01:49:41 GMT
Server: gunicorn
Connection: keep-alive

GET cksync.php
hb.yahoo.net/ 0
0

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1294&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1294&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=2533073041598370076&gdpr=0&gdpr_consent=

68 B
323 B

100ms
98ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=2533073041598370076&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=2533073041598370076&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 593ms
188ms Image
image/gif 35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

GET
H2

200

ibs:dpid=903&dpuuid=5be5cdc9-7606-42b2-a843-8f71bb977d32
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=5be5cdc9-7606-42b2-a843-8f71bb977d32

42 B
719 B

100ms
97ms

Image
image/gif

54.252.102.33
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=5be5cdc9-7606-42b2-a843-8f71bb977d32

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.252.102.33 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-252-102-33.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-apse2-2-v076-0887266fe.edge-apse2.demdex.com 4 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: BXvAP3JXQUo=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=5be5cdc9-7606-42b2-a843-8f71bb977d32
content-length: 189
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET sync
ssbsync.smartadserver.com/api/ 0
0

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=

68 B
324 B

318ms
121ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=
content-length: 323
date: Sat, 26 Apr 2025 01:49:37 GMT
server: Kestrel

GET
H2 200 / Show response
d0.eu-3-id5-sync.com/ 1 B
143 B 1097ms
347ms Fetch
text/plain 51.195.127.115
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.115 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip115.ip-51-195-127.eu
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-3-id5-sync.com/ 1 B
143 B 1096ms
347ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-3-id5-sync.com/ 1 B
143 B 1093ms
345ms Fetch
text/plain 135.125.140.162
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.140.162 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip162.ip-135-125-140.eu
Software: /
Resource Hash: 3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-3-id5-sync.com/ 1 B
143 B 1099ms
350ms Fetch
text/plain 51.195.34.220
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.220 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip220.ip-51-195-34.eu
Software: /
Resource Hash: 559aead08264d5795d3909718cdd05abd49572e84fe55590eef31a88a08fdffd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-3-id5-sync.com/ 1 B
143 B 1096ms
347ms Fetch
text/plain 51.195.115.36
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.115.36 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip36.ip-51-195-115.eu
Software: /
Resource Hash: 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-3-id5-sync.com/ 1 B
143 B 1093ms
345ms Fetch
text/plain 135.125.146.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.146.82 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip82.ip-135-125-146.eu
Software: /
Resource Hash: 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-3-id5-sync.com/ 1 B
143 B 1093ms
346ms Fetch
text/plain 51.195.73.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.82 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip82.ip-51-195-73.eu
Software: /
Resource Hash: e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-3-id5-sync.com/ 1 B
143 B 1089ms
343ms Fetch
text/plain 51.195.34.255
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.255 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip255.ip-51-195-34.eu
Software: /
Resource Hash: 6b23c0d5f35d1b11f9b683f0b0a617355deb11277d91ae091d399c655b87940d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d0.eu-4-id5-sync.com/ 1 B
143 B 1094ms
348ms Fetch
text/plain 51.195.34.255
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.255 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip255.ip-51-195-34.eu
Software: /
Resource Hash: 6b23c0d5f35d1b11f9b683f0b0a617355deb11277d91ae091d399c655b87940d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-4-id5-sync.com/ 1 B
143 B 1104ms
359ms Fetch
text/plain 51.195.34.255
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.255 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip255.ip-51-195-34.eu
Software: /
Resource Hash: 6b23c0d5f35d1b11f9b683f0b0a617355deb11277d91ae091d399c655b87940d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-4-id5-sync.com/ 1 B
143 B 1099ms
354ms Fetch
text/plain 51.195.127.100
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.100 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip100.ip-51-195-127.eu
Software: /
Resource Hash: f67ab10ad4e4c53121b6a5fe4da9c10ddee905b978d3788d2723d7bfacbe28a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-4-id5-sync.com/ 1 B
143 B 1092ms
347ms Fetch
text/plain 135.125.146.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.146.82 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip82.ip-135-125-146.eu
Software: /
Resource Hash: 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-4-id5-sync.com/ 1 B
143 B 1107ms
356ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-4-id5-sync.com/ 1 B
143 B 1098ms
354ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-4-id5-sync.com/ 1 B
143 B 1087ms
344ms Fetch
text/plain 135.125.146.80
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.146.80 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip80.ip-135-125-146.eu
Software: /
Resource Hash: df7e70e5021544f4834bbee64a9e3789febc4be81470df629cad6ddb03320a5c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-4-id5-sync.com/ 1 B
143 B 1102ms
359ms Fetch
text/plain 51.195.127.115
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.115 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip115.ip-51-195-127.eu
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 309ms
308ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=69a2fadb-d08b-4ce2-9681-8415b34fd094&ccsid=29cbd950-5e4a-4500-816a-ae24e91ae5bd
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 14 KB
4 KB 308ms
308ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: eaa7e3d32d237bf9271ddb57b4068ec273bea7ce8efcf3b3eb36f3b6b5b31206

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUY2dvzMKCJlJ5wVmuOO0ZCujncLy0WRDHZVG37lF22cYD9laMtrEDuMDTST-yUwQ0QTXJAUzqLgMnw7NIojk-jHwhYSCaDeD21ENdoC1q69UBKCgFTwh3w96s407godnddLTyAFw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-a77k15Ac8n_gpiDBlWKMQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAvxcGz8vuEAm8CMy_tPMSm5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI2M9A_P4AgMAhXEk6g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-a77k15Ac8n_gpiDBlWKMQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 3458 5 KB
6 KB 321ms
111ms Script
text/html 207.65.33.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=35410308&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: d98b2b6434026090bae36ee36438018c5a4a498fea37108c3eeb5839bf1ceed5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 user
sync.cootlogix.com/api/ Frame 1014 0
431 B 329ms
329ms Image
text/plain 64.227.19.223
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/user?partnerId=minutemedia&gdpr=&gdpr_consent=&us_privacy=&userId=NxuVu_l9Cp_mm
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fuser%3FpartnerId%3Dminutemedia%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BpartnerId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.227.19.223 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cs-rtb.minutemedia-prebid.com/

Response headers

access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

sync
x.bidswitch.net/ Frame CACE
Redirect Chain

https://ssp-sync.criteo.com/user-sync/amazon/redirect?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24UID
https://x.bidswitch.net/sync?ssp=criteo&custom_data=FNF27V9xUjlmeGJKVVFYJTJCWHRpZjhjS0JaTzdlOFo3NkolMkJZYUdtQ0VncldZJTJCZVk2SVNBdXl6eERVQ05TMUZhdFU0ZUNrdTFKdkVvU3hhcmQzTm92TTRMJTJCNWxhZ3dZeHVvMkRJO...

43 B
92 B

199ms
191ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=criteo&custom_data=FNF27V9xUjlmeGJKVVFYJTJCWHRpZjhjS0JaTzdlOFo3NkolMkJZYUdtQ0VncldZJTJCZVk2SVNBdXl6eERVQ05TMUZhdFU0ZUNrdTFKdkVvU3hhcmQzTm92TTRMJTJCNWxhZ3dZeHVvMkRJOWNrbjZrZEIwSW5SUDJZSzg3Y3ZaZkZZRjBoeTl3Y0lDd0FZQUVHcDVZenF6VldheGJOZ3pxc3ZoYUlQcFI0OURlV1VZUjBGTjNPSVo0YjFXS1pMa2tmZnJqJTJCRFk4SzhUM0V4Z3ozbkJtOEV2VjU1UHR5diUyQjdYa2VjdkUycHJWY1FwTW1ocDRRN09RODY1MSUyRlhMczNDaFFnTW1EU3FCOFU&gpp=&gpp_sid=&gdpr=&gdpr_consent=&us_privacy=&cr_user_id=k-0oMQP-dfioC_jX1wytD1vFV5KgoWOybvl5dh1Q
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
location: https://x.bidswitch.net/sync?ssp=criteo&custom_data=FNF27V9xUjlmeGJKVVFYJTJCWHRpZjhjS0JaTzdlOFo3NkolMkJZYUdtQ0VncldZJTJCZVk2SVNBdXl6eERVQ05TMUZhdFU0ZUNrdTFKdkVvU3hhcmQzTm92TTRMJTJCNWxhZ3dZeHVvMkRJOWNrbjZrZEIwSW5SUDJZSzg3Y3ZaZkZZRjBoeTl3Y0lDd0FZQUVHcDVZenF6VldheGJOZ3pxc3ZoYUlQcFI0OURlV1VZUjBGTjNPSVo0YjFXS1pMa2tmZnJqJTJCRFk4SzhUM0V4Z3ozbkJtOEV2VjU1UHR5diUyQjdYa2VjdkUycHJWY1FwTW1ocDRRN09RODY1MSUyRlhMczNDaFFnTW1EU3FCOFU&gpp=&gpp_sid=&gdpr=&gdpr_consent=&us_privacy=&cr_user_id=k-0oMQP-dfioC_jX1wytD1vFV5KgoWOybvl5dh1Q
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame CACE
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1745632178199
https://ad.turn.com/r/cs?pid=45&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004&rndcb=4811378710
https://sync.1rx.io/usersync/turn/4130458107486119565?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-2a5c99f9-d76c-477a-b776-ea00...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004

43 B
479 B

313ms
312ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: VDESE02NEW4FY0607NSZ
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:40 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-2a5c99f9-d76c-477a-b776-ea00e998a052-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Sat, 26 Apr 2025 01:49:40 GMT
etag: RX2a5c99f9d76c477ab776ea00e998a052004
content-type: text/html

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame CACE
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3886337779037281000V10

43 B
479 B

749ms
313ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3886337779037281000V10

Requested by

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 3GEZYJNGXS9ZFAX09PAB
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3886337779037281000V10
Pragma: no-cache
Connection: keep-alive
Expires: Sat, 26 Apr 2025 01:49:38 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: text/html
Server: Apache

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame CACE
Redirect Chain

https://match.prod.bidr.io/cookie-sync/amzn?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID
https://match.prod.bidr.io/cookie-sync/amzn?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID&_bee_ppp=1
https://s.amazon-adsystem.com/ecm3?id=AAFQAk7QGHcAABsdZoRnJQ&ex=beeswax.com

43 B
479 B

393ms
311ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=AAFQAk7QGHcAABsdZoRnJQ&ex=beeswax.com

Requested by

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 4KHV85V04JFVMAP4NDNM
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://s.amazon-adsystem.com/ecm3?id=AAFQAk7QGHcAABsdZoRnJQ&ex=beeswax.com
Content-Length: 0
Date: Sat, 26 Apr 2025 01:49:38 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame CACE
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub12058951686464&k=us
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=61a2e49bfde5162b&gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub12058951686464
https://t.adx.opera.com/sync?vendor=60369&pubid=pub12058951686464
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=opera.com&id=OPUe6acaa70467248f898b97e14bb995b09

43 B
479 B

692ms
327ms

Image
image/gif

52.94.223.167
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=opera.com&id=OPUe6acaa70467248f898b97e14bb995b09

Requested by

Protocol

HTTP/1.1

Server

52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: BEHNEXB9E47E8JSB5ZAE
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:40 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=opera.com&id=OPUe6acaa70467248f898b97e14bb995b09
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
expires: Mon, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
content-length: 120
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: text/html; charset=utf-8
server: Tengine
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame CACE
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=M9XKBR6A-Q-CRKN&ex=d-rubiconproject.com&status=ok

43 B
479 B

728ms
312ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=M9XKBR6A-Q-CRKN&ex=d-rubiconproject.com&status=ok

Requested by

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: J3F2PBMC9VEG0A234WKC
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=M9XKBR6A-Q-CRKN&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c80248407eff6cf595ce43a76c04e23f
content-length: 0
Content-Type: text/html

GET
H2 200 101959
jadserve.postrelease.com/suid/ Frame CACE 43 B
535 B 723ms
241ms Image
image/gif 44.227.162.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/101959?ntv_r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dnativo.com%26id%3DNTV_USER_ID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.227.162.95 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-162-95.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin: *
content-length: 43
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
server: nginx

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame CACE
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://b1sync.outbrain.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&s=2
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&obuid=14059f82-82d4-4694-a479-628b655c424e&s=2
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=14059f82-82d4-4694-a479-628b655c424e

43 B
479 B

311ms
311ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=14059f82-82d4-4694-a479-628b655c424e

Requested by

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: J40TRXHGCSVH4B5YRP0E
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:40 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=14059f82-82d4-4694-a479-628b655c424e
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 117
date: Sat, 26 Apr 2025 01:49:40 GMT
content-type: text/html; charset=utf-8

GET
H2

200

sid Show response
mug.criteo.com/ Frame 7B0A
Redirect Chain

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1
https://mug.criteo.com/sid?cpp=HPY09HwwL3BpTlhXQ2t2a05SYXZKRTJsajFobXcvaVhjUzNDWjI3eExuK0dFM0Jib0pIR09XbENnQTlIODNQY2x0alNJQVVNdnp5WXN1TXVidDJEMlNiNXFsVDcvVXdwUmpoU2VHVm1SaVhsTlBiMGR1bnJmdDV0VDRpTy...

2 KB
2 KB

148ms
144ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=HPY09HwwL3BpTlhXQ2t2a05SYXZKRTJsajFobXcvaVhjUzNDWjI3eExuK0dFM0Jib0pIR09XbENnQTlIODNQY2x0alNJQVVNdnp5WXN1TXVidDJEMlNiNXFsVDcvVXdwUmpoU2VHVm1SaVhsTlBiMGR1bnJmdDV0VDRpTy82SCtUQW1jOUJYZVRqek80bmxwcFpCMzdDZTJndEJnamg2OGE4RzhHa3RTNWkwa3BSdXl4YnNoZUs4ME9SKzFseVB2Z0JDbVlKQmhmcFUyMXZ4UU93US9ZZGlzR1Z2Vy9YbzBUVFpNSzU2VFROSVVGK2U1VEgyWVNXV09Yb3lBN0dSRGVJY2l1V04zU2ZuSWNpckpSMkZBMkZZZHlXSVptdW41NVVlUjdNOUtpeVI3SndVQVp4T2dYM3p2bTZVWFZzbkdhVXVIdnw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

8803144c57cd78b86c0967c8f23e5dde822b372a40afd476815bc73c3c843ec2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1314883
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=HPY09HwwL3BpTlhXQ2t2a05SYXZKRTJsajFobXcvaVhjUzNDWjI3eExuK0dFM0Jib0pIR09XbENnQTlIODNQY2x0alNJQVVNdnp5WXN1TXVidDJEMlNiNXFsVDcvVXdwUmpoU2VHVm1SaVhsTlBiMGR1bnJmdDV0VDRpTy82SCtUQW1jOUJYZVRqek80bmxwcFpCMzdDZTJndEJnamg2OGE4RzhHa3RTNWkwa3BSdXl4YnNoZUs4ME9SKzFseVB2Z0JDbVlKQmhmcFUyMXZ4UU93US9ZZGlzR1Z2Vy9YbzBUVFpNSzU2VFROSVVGK2U1VEgyWVNXV09Yb3lBN0dSRGVJY2l1V04zU2ZuSWNpckpSMkZBMkZZZHlXSVptdW41NVVlUjdNOUtpeVI3SndVQVp4T2dYM3p2bTZVWFZzbkdhVXVIdnw&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 305544
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
server: Kestrel

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame BEC1 3 KB
1 KB 98ms
97ms Document
text/html 52.76.116.238
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.116.238 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-116-238.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bec44133809c85afbfeea74fbb464593ecf071a363c063f570d3d30dcbca9455

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sat, 26 Apr 2025 01:49:37 GMT
etag: W/"0390d087ade0868e49c4967e9e93400bd"
server: nginx
timing-allow-origin: *

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 65B5
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
1 KB

117ms
116ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c69acc1b16dbc32030c10371ade6680f765b7a00eafe8b32d2819d450e77c822

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93626cb88b9d865f-PER
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:49:38 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HXpxE6%2FAgdQc546S8OIusiHiOl%2BJ0BcLDhAi1MNO5eJnfF2jcsK0nVboZZC9rWX9VeUoKKiABRNe%2BBlgPbzUsUnMKmCz%2FpMo0D05%2FSEQcDRAUS%2B8bGUAtsDSLkzfzwH17C2ssT6IAaFjyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93626cb7cb2f865f-PER
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Ga59PG%2BQMLX4TpZ4LpaZWW220D232ASvqybC9Eua4JO21ZxVwJdmYiKZfdkWrEApldxrhjSie%2Fcw6yhgVdp5BMFwMVuPs5lUz6Bf205DeCBrwLiHNURRCh8H%2BQj%2FSNA2FBoHlXlLzz2Tg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H3

200

cm Show response
u.openx.net/w/1.0/ Frame A981
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

714 B
734 B

173ms
171ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 841aefe17d38dbe1c35b848d9afc53d00cbb4159d50a700a5ed33e80f4f0a6e3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 714
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.100

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Sat, 26 Apr 2025 01:49:36 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.100

GET
H2

200

sync Show response
sync.inmobi.com/ Frame E6D2
Redirect Chain

https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true

6 KB
2 KB

412ms
412ms

Document
text/html

35.212.52.97
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.52.97 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 97.52.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: 5e3f9ab959a89a6f950f1bc0a226318d010bf7c60ec9182618d66d680cd4f5ca

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sat, 26 Apr 2025 01:49:38 GMT
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Accept-Encoding
x-envoy-upstream-service-time: 123

Redirect headers

content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
location: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time: 0

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame CF1C 597 B
808 B 99ms
98ms Document
text/html 54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

14c975e0e078defee650db631b4dcf87f6ebfa55fe5fd2fefa9ddd432a035dac

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 597
strict-transport-security: max-age=16000000; includeSubDomains; preload;

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B2B6 20 KB
7 KB 97ms
96ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=45199
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: Sat, 26 Apr 2025 14:22:56 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 tamptsync Show response
sync-amz.ads.yieldmo.com/ Frame 00E8 1 KB
1 KB 401ms
95ms Document
text/html 13.213.250.145
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.213.250.145 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-213-250-145.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 9324bc4147534c8e57f2cc04e4cdd836f6da7c9fc212d86a692529db918c6df7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers: Cache-Control, Pragma, *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Sat, 26 Apr 2025 01:49:38 GMT
pragma: no-cache
vary: accept-encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 3E3A
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1069037770076924640144

43 B
479 B

318ms
318ms

Document
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1069037770076924640144

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:49:38 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: K9CPG8FE1SYH3ND6WGD9

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1069037770076924640144
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

xuid
eb2.3lift.com/ Frame 3B7A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

203ms
202ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 3B7A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELZkr1skDN9gvzTMKbOLAMQ&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
476 B

183ms
181ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELZkr1skDN9gvzTMKbOLAMQ&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELZkr1skDN9gvzTMKbOLAMQ&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 3B7A
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D

170 B
232 B

197ms
196ms

Image
image/png

142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1

Protocol

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-1-48-82.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:37 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 3B7A
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

180ms
180ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 3B7A 0
848 B 427ms
267ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4644569080041589825138&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 90AFBD14A56441DB837725E184DB2233 Ref B: PER311000105023 Ref C: 2025-04-26T01:49:37Z
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYzpKniV7BmgNdV6uB2pQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT

GET
H/1.1 200
OK 88342
i.liadm.com/s/ Frame 3B7A 0
208 B 1387ms
307ms Image
text/plain 52.1.48.82
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=4644569080041589825138

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.48.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Sat, 26 Apr 2025 01:49:39 GMT
trace-id: 40c524c727ef3862
Request-Time: 0
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 3B7A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/4644569080041589825138?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-mHzMWl9E2oTcPeJK5yZkIPPYcjd8.iMCGdpiwIrK0g--~A&dongle=0883

37 B
476 B

183ms
181ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mHzMWl9E2oTcPeJK5yZkIPPYcjd8.iMCGdpiwIrK0g--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mHzMWl9E2oTcPeJK5yZkIPPYcjd8.iMCGdpiwIrK0g--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 3B7A 42 B
689 B 328ms
157ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=4644569080041589825138&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "9def19a40b5db1:0"
x-msedge-ref: Ref A: 11F26F32ED5F471083ACE34532EDA81E Ref B: PER311000106021 Ref C: 2025-04-26T01:49:37Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif
last-modified: Thu, 24 Apr 2025 17:40:58 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 3B7A
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=5020b6419d9d0a6f&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQACsMPVP8OFQgJynBPBAQEBAQEBAQCXbsgx7AEBAQEBAQEB&expiration=1745718578&is_secure=true&gdpr_consent=&gdpr=0

37 B
476 B

183ms
181ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQACsMPVP8OFQgJynBPBAQEBAQEBAQCXbsgx7AEBAQEBAQEB&expiration=1745718578&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQACsMPVP8OFQgJynBPBAQEBAQEBAQCXbsgx7AEBAQEBAQEB&expiration=1745718578&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 3B7A
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&dongle=4430

37 B
476 B

183ms
182ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&dongle=4430
Content-Length: 141
Date: Sat, 26 Apr 2025 01:49:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 setuid
prebid.intergient.com/ Frame 3B7A 0
898 B 792ms
792ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=4644569080041589825138
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632178&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=vKX0nChVp4%2BAbYeHrgaFQ6sPhs445Ae0g9Y%2BzwYKpJU%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632178&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=vKX0nChVp4%2BAbYeHrgaFQ6sPhs445Ae0g9Y%2BzwYKpJU%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93626cb7ee727384-PER
server: cloudflare

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 105ms
99ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 205526
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 423ms
228ms Fetch
text/html 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.204.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd09s25-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame F518 44 KB
11 KB 97ms
96ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 8d0b334d490a6a01f9012c592812f078bc6393ddc87a6033f76de614e0693514

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=39775
content-encoding: gzip
expires: Sat, 26 Apr 2025 12:52:32 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Sat, 26 Apr 2025 01:49:37 GMT
last-modified: Fri, 25 Apr 2025 12:52:33 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame F529 44 KB
0 92ms
92ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 8d0b334d490a6a01f9012c592812f078bc6393ddc87a6033f76de614e0693514

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=39775
content-encoding: gzip
expires: Sat, 26 Apr 2025 12:52:32 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Sat, 26 Apr 2025 01:49:37 GMT
last-modified: Fri, 25 Apr 2025 12:52:33 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BEC1
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=1879256767580541313

35 B
250 B

398ms
108ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=1879256767580541313
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Sat, 26 Apr 2025 01:49:38 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: no-store, no-cache, private
location: https://usersync.gumgum.com/usersync?b=apn&i=1879256767580541313
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.100; 103.108.231.100; 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 4e7bb52e-6080-43e6-a55d-f9aa00b0b2e9
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 sync
x.bidswitch.net/ Frame BEC1 43 B
92 B 197ms
189ms Image
image/gif 35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_3a142202-2d58-4dd6-87ee-43902d04b83b&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BEC1
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=b863cdde-029e-441d-9600-902452779930

35 B
250 B

386ms
97ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=b863cdde-029e-441d-9600-902452779930
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Sat, 26 Apr 2025 01:49:38 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://usersync.gumgum.com/usersync?b=opx&i=b863cdde-029e-441d-9600-902452779930
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BEC1
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=Ai_vkLg-XRdMzuQM5jZW7Gds52Q

35 B
250 B

102ms
101ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=Ai_vkLg-XRdMzuQM5jZW7Gds52Q
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Sat, 26 Apr 2025 01:49:39 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=Ai_vkLg-XRdMzuQM5jZW7Gds52Q
Content-Length: 99
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BEC1
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-9f8E8f9E2pfgYrqwixAgTcXyD26mQ4U68dEq~A

35 B
250 B

392ms
105ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-9f8E8f9E2pfgYrqwixAgTcXyD26mQ4U68dEq~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Sat, 26 Apr 2025 01:49:38 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://usersync.gumgum.com/usersync?b=oth&i=y-9f8E8f9E2pfgYrqwixAgTcXyD26mQ4U68dEq~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BEC1
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%...
https://usersync.gumgum.com/usersync?b=vnt&i=82da5a8e-7034-4ea3-8466-ae6156a00274

35 B
250 B

98ms
97ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=82da5a8e-7034-4ea3-8466-ae6156a00274
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Sat, 26 Apr 2025 01:49:39 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

X-CI-RTID: dc2fba47-3f73-44b2-9b66-53b822af602f
Location: https://usersync.gumgum.com/usersync?b=vnt&i=82da5a8e-7034-4ea3-8466-ae6156a00274
Content-Length: 108
Date: Sat, 26 Apr 2025 01:49:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 142
match.deepintent.com/usersync/ Frame BEC1 0
16 B 1024ms
319ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 26 Apr 2025 01:49:38 GMT
server: a
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BEC1
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_3a142202-2d58-4dd6-87ee-43902d04b83b&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://b1sync.outbrain.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=&gdpr_consent=&puid=a_3a142202-2d58-4dd6-87ee-43902d04b83b&s=2&us_privacy=
https://b1sync.zemanta.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=&gdpr_consent=&obuid=e0697e37-8a62-4280-9692-eac4ef50adaf&puid=a_3a142202-2...
https://usersync.gumgum.com/usersync?b=zem&i=e0697e37-8a62-4280-9692-eac4ef50adaf

35 B
250 B

98ms
97ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=e0697e37-8a62-4280-9692-eac4ef50adaf
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Sat, 26 Apr 2025 01:49:40 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://usersync.gumgum.com/usersync?b=zem&i=e0697e37-8a62-4280-9692-eac4ef50adaf
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 108
date: Sat, 26 Apr 2025 01:49:40 GMT
content-type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame BEC1
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&us_privacy=&gpp=&gpp_sid=&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=E7GXXB00HOJJ&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355

35 B
208 B

102ms
97ms

Image
image/gif

52.76.116.238
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=E7GXXB00HOJJ&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Server: 52.76.116.238 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-116-238.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
expires: 0
content-length: 35
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif;charset=UTF-8
server: nginx

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://rtb.gumgum.com/usersync?b=pln&i=E7GXXB00HOJJ&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-bbfcf7f8d-hpwhr
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-AU
server: Jetty(12.0.17)

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BEC1
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=5829103733374201334

35 B
250 B

383ms
101ms

Image
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=5829103733374201334
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Sat, 26 Apr 2025 01:49:38 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

date: Sat, 26 Apr 2025 01:49:37 GMT
location: https://usersync.gumgum.com/usersync?b=sad&i=5829103733374201334
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame BEC1 43 B
479 B 543ms
313ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=a_3a142202-2d58-4dd6-87ee-43902d04b83b

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: GPE7DGFQ56XT4MP1SJV2
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame CF1C 43 B
479 B 316ms
316ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=2ea5ca41-c19e-425d-b433-5a4b050e541e

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: PVXQ7RTRNBM19F3MKFK4
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2

200

v1
match.sharethrough.com/sync/ Frame CF1C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=

68 B
323 B

118ms
117ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=
content-length: 323
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/ Frame CF1C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=MmVhNWNhNDEtYzE5ZS00MjVkLWI0MzMtNWE0YjA1MGU1NDFl
https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=

68 B
323 B

99ms
99ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-cache, must-revalidate
location: https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 260
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

v1
match.sharethrough.com/sync/ Frame CF1C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&gdpr=0&gdpr_consent=

68 B
323 B

96ms
96ms

Image
image/png

54.254.2.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&gdpr=0&gdpr_consent=

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Server

54.254.2.214 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-254-2-214.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://match.sharethrough.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Location: https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&gdpr=0&gdpr_consent=
Content-Length: 202
Date: Sat, 26 Apr 2025 01:49:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET sync
ssbsync.smartadserver.com/api/ Frame CF1C 0
0

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUY2dvzMKCJlJ5wVmuOO0ZCujncLy0WRDHZVG37lF22cYD9laMtrEDuMDTST-yUwQ0QTXJAUzqLgMnw7NIojk-jHwhYSCaDeD21ENdoC1q69UBKCgFTwh3w96s407godnddLTyAFw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-bGK_IB85BRPagL7Cf0Mc1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0ZBi-FB_mfUHEAvxcGz8vuEAm8CNi0dvMSu5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI2M9A_P4AgMAopolSw"
content-security-policy: script-src 'report-sample' 'nonce-bGK_IB85BRPagL7Cf0Mc1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUY2dvzMKCJlJ5wVmuOO0ZCujncLy0WRDHZVG37lF22cYD9laMtrEDuMDTST-yUwQ0QTXJAUzqLgMnw7NIojk-jHwhYSCaDeD21ENdoC1q69UBKCgFTwh3w96s407godnddLTyAFw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-E67GNScLhJ1uedSEwBS5ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAvxcGz8vuEAm0DH_mO3mJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJkbGegXl8gQEAgb8k3g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-E67GNScLhJ1uedSEwBS5ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxVSHoF83M22IKCXWxdG2IzXXNcO9aEwGe8FMxll1N_yOVDmSIP6M1G5LgP1yNRGEDXa9Wh0jDCSFGrYZJshYW4vjtcoohJefqCKpZ48PQPZ91GFhiTrRq6IGA4kOCCuFtk-MSzs-A== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 221ms
220ms Script
application/javascript 142.251.221.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVSHoF83M22IKCXWxdG2IzXXNcO9aEwGe8FMxll1N_yOVDmSIP6M1G5LgP1yNRGEDXa9Wh0jDCSFGrYZJshYW4vjtcoohJefqCKpZ48PQPZ91GFhiTrRq6IGA4kOCCuFtk-MSzs-A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjMyMTc3LDg5MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJpQ1hMZFVyOW4wVSJdLFs5LCJlbi1HQiJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmF2YXNwb3JlbGlnaHQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7c8a3a9362bbce46e9e015d602067866ad55a5b0e168b525a2cc57d73adcb28

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xOScBtjrSvv_1-ji_gDAYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw05BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GTdtfEW62EgbtK-zdoFxELcHJu-bzjAJvDiyXlWJY2k_ML45Py8kqLMpNKS_KK05LTU4tSistSieCMDI1MDEyMTPQOD-AIDAGHxO7Q"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xOScBtjrSvv_1-ji_gDAYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 67EA
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1301&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=adf&i=2533073041598370076&gdpr=&gdpr_consent=

35 B
250 B

97ms
97ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=adf&i=2533073041598370076&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:49:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT
expires: -1
location: https://usersync.gumgum.com/usersync?b=adf&i=2533073041598370076&gdpr=&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame E5C9 170 B
243 B 217ms
196ms Document
image/png 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV8zYTE0MjIwMi0yZDU4LTRkZDYtODdlZS00MzkwMmQwNGI4M2I=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:49:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8AAA 20 KB
7 KB 111ms
92ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=45199
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: Sat, 26 Apr 2025 14:22:56 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame EF4D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=5be5cdc9-7606-42b2-a843-8f71bb977d32

35 B
250 B

413ms
97ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=5be5cdc9-7606-42b2-a843-8f71bb977d32
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:49:38 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 193
date: Sat, 26 Apr 2025 01:49:38 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=5be5cdc9-7606-42b2-a843-8f71bb977d32
server: Kestrel

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 59FE
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=aAw7ssCo5swAAJCcESQAAAAA

35 B
250 B

100ms
96ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=aAw7ssCo5swAAJCcESQAAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:49:38 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Sat, 26 Apr 2025 01:49:38 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=aAw7ssCo5swAAJCcESQAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 1
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad1009.dc4p.scaleout.jp
X-SO-IP: 103.108.231.100
X-SO-Key: aAw7ssCo5swAAJCcESQAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"103.108.231.100","key":"aAw7ssCo5swAAJCcESQAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad1009"}
X-SO-LB-Hostname: a-tgng40008.dc2p.scaleout.jp
X-SO-Upstream-ID: m-ad1009

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 626A
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=QU53o-mYO0qGmqeGU07s8sSAguXEIIDAip6vGXd7p-Y&pi=gumgum&tc=1

35 B
250 B

100ms
100ms

Document
image/gif

54.254.86.192
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=QU53o-mYO0qGmqeGU07s8sSAguXEIIDAip6vGXd7p-Y&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.86.192 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-86-192.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:49:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT Sat, 26 Apr 2025 01:49:39 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=QU53o-mYO0qGmqeGU07s8sSAguXEIIDAip6vGXd7p-Y&pi=gumgum&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

xuid
eb2.3lift.com/ Frame 5EB1
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

276ms
182ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=5be5cdc9-7606-42b2-a843-8f71bb977d32&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 5EB1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELZkr1skDN9gvzTMKbOLAMQ&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
476 B

196ms
182ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELZkr1skDN9gvzTMKbOLAMQ&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELZkr1skDN9gvzTMKbOLAMQ&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5EB1
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D

170 B
232 B

198ms
195ms

Image
image/png

142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-1-48-82.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 5EB1
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0NDU2OTA4MDA0MTU4OTgyNTEzOA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

185ms
179ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 5EB1 0
550 B 319ms
315ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1069037770076924640144&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: ACD241499BC0438F833D9B59CF4CB35F Ref B: PER311000105023 Ref C: 2025-04-26T01:49:38Z
x-li-fabric: prod-lva1
x-li-uuid: AAYzpKnkd9PxQKv3toHuvw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Apr 2025 01:49:37 GMT

GET
H/1.1 200
OK 88342
i.liadm.com/s/ Frame 5EB1 0
208 B 1227ms
307ms Image
text/plain 52.1.48.82
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1069037770076924640144

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.48.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Sat, 26 Apr 2025 01:49:39 GMT
trace-id: d61df3d2ddb3f10a
Request-Time: 0
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 5EB1
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1069037770076924640144?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-mHzMWl9E2oTcPeJK5yZkIPPYcjd8.iMCGdpiwIrK0g--~A&dongle=0883

37 B
476 B

298ms
184ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mHzMWl9E2oTcPeJK5yZkIPPYcjd8.iMCGdpiwIrK0g--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mHzMWl9E2oTcPeJK5yZkIPPYcjd8.iMCGdpiwIrK0g--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 5EB1 42 B
286 B 158ms
155ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1069037770076924640144&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "9def19a40b5db1:0"
x-msedge-ref: Ref A: BA4D589DE4914BFFB96EE9799056D278 Ref B: PER311000106021 Ref C: 2025-04-26T01:49:38Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif
last-modified: Thu, 24 Apr 2025 17:40:58 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 5EB1
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=f22119fa7070aaa&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQACtFFT37-kVgJND9O4AQEBAQEBAQCXbsgwlwEBAQEBAQEB&expiration=1745718578&is_secure=true&gdpr_consent=&gdpr=0

37 B
476 B

182ms
182ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQACtFFT37-kVgJND9O4AQEBAQEBAQCXbsgwlwEBAQEBAQEB&expiration=1745718578&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQACtFFT37-kVgJND9O4AQEBAQEBAQCXbsgwlwEBAQEBAQEB&expiration=1745718578&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 5EB1
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&dongle=4430

37 B
476 B

187ms
187ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-022fef90-b83e-5d17-4cce-e40ce63656ec$ip$103.108.231.100&dongle=4430
Content-Length: 141
Date: Sat, 26 Apr 2025 01:49:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET

cs
cs.lkqd.net/ Frame 71D0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm
https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEIXAquBqo_Fenp0DA7g0JHk&google_cver=1

0
0

GET cs
cs.lkqd.net/ Frame 71D0 0
0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 71D0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1

43 B
768 B

118ms
118ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxD0x1UY6Lr_vgEwAQ&v=APEucNXiPB-b3F1SLS7FBVicUKJM4mVSGDaXecbGx7v5Up7XApxbt2rU6pG4B11ADYsERXxELI1m7rw1JpB3ZHRBVGPfPGz7EQ
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u7EgdYxOaTGNdDwf3EmI7my1ckt%2BiJyqGe%2F1Pabqi5f3OkIQ%2Fn4PjATUjAkHM1l8UaQp07PosRuFPhxpCtRBEKRHhowXn%2BIS57%2BmgqehgJvN9AoG5Yl3HogWW%2BCK4tzISxl0OJjEFyqlpw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626cba3ce2865f-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 71D0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAw7sYsFVXMALOihAO8CPAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1

43 B
773 B

124ms
117ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxD0x1UY6Lr_vgEwAQ&v=APEucNXiPB-b3F1SLS7FBVicUKJM4mVSGDaXecbGx7v5Up7XApxbt2rU6pG4B11ADYsERXxELI1m7rw1JpB3ZHRBVGPfPGz7EQ
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BrQ2S8Y%2BEOMjpsK9J9mcuo9kMksKcVQ6PBJlGPCi5%2F40Tm7p%2BF4WtZ%2F2kFR%2BiQFH4rnhxdjGEDS12q4o4uAiFIt%2FLrKnvXeKxMKqYykE3BwYQbzw%2Bgj%2BMXuHtoIhHqyYdtV3tkmNMBPYLg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626cbbfdaa865f-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 9061 0
921 B 275ms
271ms Script
text/html 103.43.90.114
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.114 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 103.108.231.100; 103.108.231.100; 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 410392e1-6fd1-4363-998e-135a03eae759
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26D1 0
20 B 258ms
257ms Ping
image/gif 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=586229609066&version=m202504010101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26D1 0
20 B 252ms
252ms Ping
image/gif 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=586229609066&version=m202504010101&ct=76&x=13&cor=4371353070578602500

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 26D1 98 KB
41 KB 271ms
266ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DA69bx1V9pVP5xj9LkrurloiwB3mjyw4K9A7a2yZHhRzioLGBmllDa4T3ROgZ2JXtWl0-fKLmyHv82OXwpB6PSIWtS7KBtXtemVuWAZU9nxzXl9zah2WL-HxQKNgGy3A_VgO12UsT5vkYDdixmKHaeYA-tsclsiHY72dBYVBM085nJaYqrYhPwyD8c6Mm3V5vQFB_59vo6nxBQcmJoE2j9D1oSmzKMtqNa5qK5JQIvnBwYTnienTB423WcyRLozhfWxUAJCi7yX7NFoa51R7QPkB6cNA&dbm_d=AKAmf-CAvfUcjTxyPrcsarFhOzd0c_Vx2U98-OZeDndbTRWAh6YHGkIS0RGOh_ttdwklQ1xtKQZZCERr493vxmBzfpFM1ILISZY38xqPmG0VAXKPCGJujyr28SP5UnCCWALOXkUkWyug-IWT5UJm_pD_DHVR7oVPosUPNImgR8jXEsCfCeLfdJ3SAfymKvgZtxSyxxZFeStcScKwQXFIFzdktf_ZBwEyNXydBeKE4j4W1j4-Py0N1n8oh4j0ir8uTVkv71iufE4_86YU4gHGTiqp3OLo5_IXYYAM4WFJTi2CqDdUlyNBG574p4XFpD6vpl2_LwdgG5R_eoh7o34UJwx9L2GeO28HEH83QWRsVI2eSLxNJ6oBE3YRyeeD0_XISpb6AQyEzC4CYyZ5DsPNVAvh7UJoi-EPRDmBgrfifFsMP2JQMCDWedlPyDTJGLt8-E8Xj5j6YNSc1APv5Mios4EdfNVndtm-JZXKnrh24HREVeDylB1DtYoWo27FcprjfX0OSJVeJyRw3SEsC75iXmkDKDpoRbE4GkXxe509N5Ur58TUDGR9jp3Q0OMzkSZRtbPlngWsW4roFjvMmpWU9pEFZvXzPq_YmF7xEzRJgyX51_qV6A2KlBQsTB4D4xDaICS4ffu7ibTmpotfcLlKZjtzoK5421uSs-4ASuobk2OUQDiUdKpxaWyzeJIx1YKB0LABAdBpQnmEQkkr2iY_j3W1a3yTAxFGHzdFxdEREBB-3fqCOukwDbycA9TiJWs2ngdAQ6JajFdA-CjW3vVm1YqNDO8ExVv8WgsTXq4QSbDlWUzy6WtGLMdtAHRITUYLn8vAQVJggPLSo-bfizf8by3FGZ0rD746Dgh83cRx2RnS-tnGUbxgPibkKbGRWZLlCgWq8EaraezurNFTq8tChlQcNAkxtYPP2m5Dm2zkPjvfK-m4M2Q7mHDWV8ELBuCV4Bku6oLDlB5xW4amkewsfqvUdh86G5L7qqFF8pY7uy-nli4Sajqog8awDZG-Hdrpluv8gu4Q_kEoicd2pahad1g2T-xiRkry4iiAXjliEXlGZXBdHE1jBqyu8xpHjH4f5xUECD10VHDU4U8oeUYB9qA5DyOGGxK2kFzc2o-sKzR8uL_NB_FP_paLc5dCJjxneBPFdX_Z8rw0s94akxiVd6W_wVOe5hD4LY9-Wh01Z9bpf6sTEBg3SgpccHai-SPL3Oi2PZXFh2JVRArnna7LlhbBvUK4s7SDtNVsjrJWVAlcv_QJ6NleZVb1mcBUZSW_1ZauUgbtVaqWxtW8hqTtk31XXxR_682nhIld-YqKHs8ehlMNY5fSxV4JWbJpFm7GdHozg0OXOYOzlvroRJhABom9q39lTndUBr5JMJh6VltGWoPgQ7g3puUtfDumB7OQ6NrJd7D3R7yyjKILhELdD8O33OTNWaWLduV6JAQ5JcUICziCKERe9cUdEruvT1CX5QWR_pgKC4-DkkryNFkgrVPsJ4GWKxC-YXzrENiubH0cmEnlANWOmKKF11CM6wCf2BoYq3Uy0u7BbBPkiJ9hUsuxck8y-ZHWw3WocxkNcshXlz2wYOUtRoqHL5ZXLaoWcyCidz9CsbhLYwl4FJLp6YOdS0yXezQlG1vUpDmYt6wmYzRVX9Bh-t3frRazGORNSE1xh-D_3cwkxM1OzrKV3Vcjot40s0rYlPGrqepFrMcgHVK_tpkXOtVymHvU8wIfW1Ik7379uRvE49YyBtEaJVh8t0H0Jj3f_YI068O8tC8lzAZb7CeNitiMqZpYEWWMN7c3va6y3x9AgDkJoVHH0mRWCSx8vrQLckd5GHVVcipLD3LQdY6SX3OSoPPcsquL6Y1JJT_sjQM9c6Qf-pS85BDuth1RU39qehLRYgDFHq5RElXJ1JK3f6HYL2kDFNCw5hV1maJh1Vc-_dFujQzbqTliCimbPaPbs0wi9h2wW-XIINOVBIKZHxHLI5Vj0KdFeQOypNrVOvQhGxG-uKW7uvaRciyI_W80AQUC--rxV8Ztx5jWuhWp5VPgvqR8Gdpx0RW2zPVCe3Dk6yusQqteY2GJkGxdsCLbidTDMq19rU78cYzvP_TSaqWttjqfL_lVE-96QdEbWK4lq0sPOR9GoElEGmSg739A44GLfA-S4wa186ayjifxMBYV1r_IQBapya0Gl8HdXjpLehIzgc545qFqArEpHW0F74vjpPHjdVehLnrWBnFUND-etCCxZ0KjPseNAxonD43Iddf1cXFCqGmj1aPu9fX70JXTNxrqoBB1YTK47C45J5b26uNVTdFqMErYfdLNi_DhNVDhA1NuG3eEoMyyBFIaoNYHZKuOev8uqHdrxc7B0MFFX93oOIFKp5ujDhUwhKnnffsN8jgygsRv1MtGZRzrIXWOniSvO2_bXm_pWrq0FT814JWKu0q9Dm2hQl75qq3dP9QcjhI1RIULzGvYTgslv46xAAbAHTqM3KHcyD1dE9dEbv61cmSEilOkrP6evtpJCiIwvSxPT1mHiPEpAF-8oRWCR4Q6qKiVwetxokdu5DNkdiB7XbP7CuSme1sD70JsSMgyTVt6yt_ImXmloX1VbYr_oy_EZdPUW8qpZoR4teBpv2JeLQSQG-acDVai668raghFZqSyO8JPvdCdAWQQZl-5dctu_9TD4tLTbo8kZNCN2Dati1Y7iKcbCNiDtcuwXR1_sgVuy25OKQBJMyVhbAcRxyltNFNI7ZqPzt9KN4xpD7pMTIVNFs_UyIhxokbwbNmQeN_5zvEqZEQBfN1Mo96WqlYWgxWmM5utoi3nCj45e7o_oQpVMilh8REY4lw46QLZOu5EsE4dgLh_SFrqITMPT9O_oZJ4nhHht6Lvzb0m47JU2t4A2CtcMkj8X8X_qK6rP4aCW0X9jx3jbw4R_710t8Nv-YOY0uUtViCC_PI83i2CEgEgRatkNARikOeDV-PokD_uJwNvjxFJNgl6hK0DkVPl984Qbsray7Nt65Vb-xPQCybDG2laYApaar3NN-wY9lVOPnkCf19BRkBOhK6qXRppvhNJgjgiTRa5aODwzGNN3ftByMtFLgDDvecEAci_EparzcofY1EQG9o9UrDvK-OOcMuZcTJPrIR1ArR5pyq28E9jc-c3cheNsH5Qo_w2hC-0HV5mubErrQVC15sNiNOokoiRp8kWRrAk-Ng66VPSxZ9F0DbiiqOvBlOu-PN1soFyou7TFhJcHdbQdGbQq6ISZ-CCmlwy3xBLE5Grki91Q75DLbfMlqDNwq4eSS2kiw_uCpuAEHL3roV38DFJYM7UbBQIi10NeGsi1EIzuwp1OsWhkVKAkZ2D0bbBcWA2iKBG-fgPdASnYpxxGnMU4JuGd7oa1uDyvuCwQKKxSfoHZGrA1LAyIwcFagHNJU9wBuOpwD3JLsjPR99BjMnzYmpH2ugWAQhGno4owiefhYyEogzuyeqosw2ltoe5kxpqPus26s6Zk4MAwPz5oKA__Hc4hS5YD-6BWgg_Kfh9LNvUDozzF15Q6b4UbHuU-tWEo5NQOkOWo5K9D_7jhXzTbixGYKqM7-4ut5BYoXuh99Px5FTBaL7DceL-BdXRQH7KOeUoM7NYD9NdrxyNcgCKtd5f269Jw3hGgkZl4NZ-8wKkxcSSJSr7kEKtHwlg_eUdz8E-NnxNeDttD0BZBaW4gecbf2619_CaKc95YRs345UQ_91p5D8nEZu_IYOF0KhgE2rn-PEm5doJLl8vZ5Vtv-giFBzvKj5zuE9z7vmSw4DpYXLyhg5iz9GWS2mOGJfRF6HtWlZaNU5tru9Gxqp8-rO2C3MlZ_0UrFhenHgPPv70B4hPojO8CvEKs9TH8wIo3Xe1p58JpesXBNzOV4-CDLvgErFRE61dQUst51E&pr=13%3AaAw7rwAAAABMSTXkLC_NI5UzqZEyVBkq4ua47g&cid=CAQSYADZpuyz6p6xJSgW7dJ3bBv76vhg1QY21xcQKHUnHOilI9RNk12SpW6y5j1V5UnzDZI0u4KfT1s_-MinioHxIjBRHNpW-M2seDvEiZWRBLPfKs2scY07u9uA-rqS0k-IgRgB&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&ct=76&iif=1&cor=4371353070578602500&adk=400284106&idt=411&cac=0&dtd=89

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

729a1eeb6ef74dd1d6cb382609739040ebfe4fb4179598e2a368a3ff4734b1ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42222
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 5A85
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

269 B
379 B

102ms
92ms

Document
text/html

184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 26 Apr 2025 01:49:38 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 439A 19 KB
7 KB 209ms
79ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632175853&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 93626cb9fcf787b2-PER
access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 337ms
305ms Image
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=cd85e644-95df-46ab-bc74-276ec0daac40&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qwxz.avasporelight.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=b19b0e75-2658-49eb-ae9b-f1cf82b7d13e&ccuid=69a2fadb-d08b-4ce2-9681-8415b34fd094&sid=29cbd950-5e4a-4500-816a-ae24e91ae5bd&nct=1745632178000&r=https%3A%2F%2Fqwxz.avasporelight.com%2F&ns=true&lang=en-AU&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&devicefp=103.108.231.100%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=4883bc1b-62e3-43c0-8ae7-c5064cd69b7a&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Sat, 26 Apr 2025 01:49:38 GMT
content-length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame EBE2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOsUd88LqLsl8HKzKtlrDKk&google_cver=1

43 B
61 B

176ms
175ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOsUd88LqLsl8HKzKtlrDKk&google_cver=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOsUd88LqLsl8HKzKtlrDKk&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame EBE2 170 B
232 B 199ms
198ms Image
image/png 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NjMzMWJhNjQtZTNmYy0yMmVmLWU0OWItZGE3MDUwYzU1NjE2

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame EBE2
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ae563-Fs5tFuks8AKGbGad7G2M8AAAGWb8kybg

43 B
61 B

173ms
173ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ae563-Fs5tFuks8AKGbGad7G2M8AAAGWb8kybg
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ae563-Fs5tFuks8AKGbGad7G2M8AAAGWb8kybg
pragma: no-cache
via: 1.1 30a845a852b74a2965aabbcb6034301e.cloudfront.net (CloudFront)
expires: -1
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 1oRpSas0HvI-PP-1NsBnLNtWCcd8lVZ4-f_MmUWJLi33Wn2fgIDZbA==
date: Sat, 26 Apr 2025 01:49:38 GMT
x-amz-cf-pop: SYD3-P2

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame EBE2
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAw7ssCo5swAAJCcEUUAAAAA

43 B
128 B

184ms
173ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAw7ssCo5swAAJCcEUUAAAAA
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

Cache-Control: private
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAw7ssCo5swAAJCcEUUAAAAA
X-SO-LB-Hostname: a-tgng40008.dc2p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"103.108.231.100","key":"aAw7ssCo5swAAJCcEUUAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad1035"}
X-SO-Cluster-ID: 0
X-SO-Upstream-ID: m-ad1035
X-SO-HostName: m-ad1035.dc4p.scaleout.jp
Connection: keep-alive
X-SO-IP: 103.108.231.100
X-SO-Key: aAw7ssCo5swAAJCcEUUAAAAA
Content-Length: 0
P3P: CP="See also http://www.scaleout.jp/privacy/"
Date: Sat, 26 Apr 2025 01:49:38 GMT
X-SO-Ads-Time: 1
Server: nginx

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame EBE2
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=4f5e69ae-2a8b-7c4b-f17b-80c99a279876&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=5be5cdc9-7606-42b2-a843-8f71bb977d32&ttd_puid=4f5e69ae-2a8b-7c4b-f17b-80c99a279876&gdpr=0&gdpr_consent=

43 B
62 B

177ms
176ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5be5cdc9-7606-42b2-a843-8f71bb977d32&ttd_puid=4f5e69ae-2a8b-7c4b-f17b-80c99a279876&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5be5cdc9-7606-42b2-a843-8f71bb977d32&ttd_puid=4f5e69ae-2a8b-7c4b-f17b-80c99a279876&gdpr=0&gdpr_consent=
content-length: 335
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame EBE2
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3343824229847902181&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

171ms
169ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3343824229847902181&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3343824229847902181&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 26 Apr 2025 01:49:37 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
292 B 349ms
349ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

dc7584ba99cc71fc2b5a6e835b1ee48e7f0b105d031580608fcfb3d9fc66f8d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame 439A 4 KB
2 KB 286ms
282ms XHR
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632175853&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed62da1673bbfa1b15527ad0503d0be2acf92bab673957be3f2cd4a78899c015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=673a3f8d-1b6b-4927-a9f5-5d20bb752ab0&linkedin.com=d9db24ff-f4ea-4adc-ae89-fc804d1aad68&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632175853&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93626cb98c3f8671-PER
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame B92A
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=0&gdpr_consent=

35 B
591 B

314ms
313ms

Document
image/gif

185.84.60.20
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Sat, 26 Apr 2025 01:49:39 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame C5EF
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:ed4a680c-3bb3-4e00-b37a-baa5d350309a&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

96ms
95ms

Document
text/plain

207.65.33.79
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.79 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Sat, 26 Apr 2025 01:49:38 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D Show response
x.bidswitch.net/check_uuid/ Frame E50F
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1879256767580541313&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

190ms
189ms

Document
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif
date: Sat, 26 Apr 2025 01:49:39 GMT
via: 1.1 google

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2

200

https://cm.ambientdsp.com/cm/send?vc=pmj&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQ0OSZ0bD00MzIwMA==&piggybackCookie=18vt0pthkel4
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

188ms
187ms

Document
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif
date: Sat, 26 Apr 2025 01:49:39 GMT
via: 1.1 google

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT
location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2

200

sync Show response
x.bidswitch.net/ Frame 15FB
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=56d67bce-6d55-4622-aa92-59b185078486
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=56d67bce-6d55-4622-aa92-59b185078486
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=6bf4caff-4583-49d7-beed-c8c8871ff3b5&user_group=1&ssp=pubmatic&bsw_param=56d67bce-6d55-4622-aa92-59b185078486

43 B
92 B

188ms
188ms

Document
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=6bf4caff-4583-49d7-beed-c8c8871ff3b5&user_group=1&ssp=pubmatic&bsw_param=56d67bce-6d55-4622-aa92-59b185078486
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif
date: Sat, 26 Apr 2025 01:49:40 GMT
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sat, 26 Apr 2025 01:49:40 GMT
location: //x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=6bf4caff-4583-49d7-beed-c8c8871ff3b5&user_group=1&ssp=pubmatic&bsw_param=56d67bce-6d55-4622-aa92-59b185078486
via: 1.1 google

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 049B
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=QU53o-mYO0qGmqeGU07s8sSAguXEIIDAip6vGXd7p-Y&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&g...

42 B
348 B

101ms
99ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=QU53o-mYO0qGmqeGU07s8sSAguXEIIDAip6vGXd7p-Y&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:49:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT Sat, 26 Apr 2025 01:49:39 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=QU53o-mYO0qGmqeGU07s8sSAguXEIIDAip6vGXd7p-Y&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame A87B
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
171 B

48ms
48ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAw7sgAEqir9JAA_
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2293
cache-control: no-cache
content-length: 85
content-type: image/png
date: Sat, 26 Apr 2025 01:49:38 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 3224
x-robots-tag: noindex
x-served-by: cache-per12626-PER
x-timer: S1745632179.645084,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAw7sgAEqir9JAA_
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-per12626-PER
x-timer: S1745632178.340660,VS0,VE256

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 7C8B
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=sfGFTrSr1x-q_9Ad4_6YHub4h06q-IFI4fj-9pbA
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

202ms
88ms

Document
text/plain

207.65.33.79
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.79 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Sat, 26 Apr 2025 01:49:38 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 4FE0
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=Ai_vkLg-XRdMzuQM5jZW7Gds52Q&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

1ms
1ms

Document
text/plain

207.65.33.79
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.79 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Sat, 26 Apr 2025 01:49:39 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 2847
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=6275ed86172243c4&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub8730968190912
https://t.adx.opera.com/sync?vendor=60369&pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUe6acaa70467248f898b97e14bb995b09

42 B
314 B

98ms
97ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUe6acaa70467248f898b97e14bb995b09
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:49:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:49:39 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUe6acaa70467248f898b97e14bb995b09
pragma: no-cache
server: Tengine

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 5826
Redirect Chain

https://cr-p10.ladsp.com/cookiesender/10?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMzEmdGw9MTI5NjAw&piggybackCookie=$UID
https://cr-p10.ladsp.com/cookiesender/10?cr=true&https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMzEmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMzEmdGw9MTI5NjAw&piggybackCookie=Ae563-Fs5tFuks8AKGbGad7Gys8AAAGWb8kyFQ

42 B
212 B

103ms
95ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMzEmdGw9MTI5NjAw&piggybackCookie=Ae563-Fs5tFuks8AKGbGad7Gys8AAAGWb8kyFQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
expires: -1
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMzEmdGw9MTI5NjAw&piggybackCookie=Ae563-Fs5tFuks8AKGbGad7Gys8AAAGWb8kyFQ
pragma: no-cache
via: 1.1 e5b020a801bdf1ad3db7e2da019dad6c.cloudfront.net (CloudFront)
x-amz-cf-id: RyDtLfPCdOyveoHEo7HXiLLkXzD3IaOKwyV4_eMxmJsqB30KX5z0Xg==
x-amz-cf-pop: SYD3-P2
x-cache: Miss from cloudfront

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 3DF7 43 B
346 B 441ms
219ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Sat, 26 Apr 2025 01:49:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
via: 1.1 google

GET
H2

200

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=xgmJMLjMDsGm--q3sjsMaA
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

190ms
189ms

Document
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif
date: Sat, 26 Apr 2025 01:49:39 GMT
via: 1.1 google

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT
location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET usersyncsupply
cm-supply-web.gammaplatform.com/adx/ Frame CA7E 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2BBE
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw

42 B
95 B

95ms
95ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 93626cbbf8f104b2-PER
content-type: text/html
date: Sat, 26 Apr 2025 01:49:38 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-function: 209
x-reuse-index: 247

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 216F
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b68e2a69-2240-11f0-9190-f08bf4d668cb
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

203ms
203ms

Document
text/plain

207.65.33.79
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.79 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Sat, 26 Apr 2025 01:49:36 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 74A6 0
44 B 750ms
319ms Document
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
server: a

GET pxd
dps.jp.cinarra.com/ Frame DAC0 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3B9D
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0

0
93 B

96ms
95ms

Document
text/html

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
server: _

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 1ADD 43 B
280 B 1371ms
338ms Document
image/gif 195.5.165.20
IPROM-AS IPROM d.o.o

General

Check archive.org

Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS IPROM d.o.o, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:49:39 GMT
Vary: Accept-Encoding
X-adserver-worker: ragnarok-8ff52f9411a9@version_1.8.14
X-core-time: 1ms
X-server-arch: v2

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C894
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:jzC2YcqA1U8uFI5&gdpr=0&gdpr_consent=

42 B
215 B

95ms
95ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:jzC2YcqA1U8uFI5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:jzC2YcqA1U8uFI5&gdpr=0&gdpr_consent=
pragma: no-cache
server: PingMatch/v2.0.30-830-g0d2790f#main-gcp-migration edge-prod-apc1-8qcr@asia-southeast1
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 google

GET
H2

200

sync
pippio.com/api/ Frame 3458
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=7CBE608E-A893-46D0-9F75-2509F212774E
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDdDQkU2MDhFLUE4OTMtNDZEMC05Rjc1LTI1MDlGMjEyNzc0RRAAGg0IsvewwAYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=6fff0ba2516ba848961e950d579b4993435391e3c22f34dc5f12a6ceb9c45c2c791426b5417dce21&_=2

42 B
571 B

473ms
279ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=6fff0ba2516ba848961e950d579b4993435391e3c22f34dc5f12a6ceb9c45c2c791426b5417dce21&_=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&it=1&iv=6fff0ba2516ba848961e950d579b4993435391e3c22f34dc5f12a6ceb9c45c2c791426b5417dce21&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT

GET
H2

200

info2
uipglob.semasio.net/pubmatic/1/ Frame 3458
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=7CBE608E-A893-46D0-9F75-2509F212774E&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=7CBE608E-A893-46D0-9F75-2509F212774E&sInitiator=external&gdpr=0&gdpr_consent=

42 B
443 B

105ms
98ms

Image
image/gif

95.173.218.113
CDN77 Datacamp Li...

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=7CBE608E-A893-46D0-9F75-2509F212774E&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 95.173.218.113 Praha 10, Czech Republic, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-95-173-218-113.datapacket.com
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
routing-server-id: -1
frontend-id: 0
pragma: no-cache
expires: Sat, 01 Jan 2011 12:00:00 GMT
access-control-allow-origin: *
uip-response-status: Ok
content-length: 42
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
content-type: image/gif

Redirect headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
location: /pubmatic/1/info2?sType=sync&sExtCookieId=7CBE608E-A893-46D0-9F75-2509F212774E&sInitiator=external&gdpr=0&gdpr_consent=
routing-server-id: -1
frontend-id: 5
pragma: no-cache
expires: Sat, 01 Jan 2011 12:00:00 GMT
access-control-allow-origin: *
uip-response-status: Ok
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
p3p: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame 3458 49 B
222 B 340ms
105ms Image
image/gif 18.136.127.160
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.136.127.160 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-136-127-160.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame 3458
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=N0NCRTYwOEUtQTg5My00NkQwLTlGNzUtMjUwOUYyMTI3NzRF&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEEgmoNxq1DPk54dlElYlaJA&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

190ms
188ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:38 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 3458
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fL5gjqiTRtCfdSUJ8hJ3Tg%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEEdEQ8W_vPKbYx5-HnsvU8A&google_cver=1

10 KB
10 KB

105ms
103ms

Image
text/html

23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEEdEQ8W_vPKbYx5-HnsvU8A&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=45198
content-encoding: gzip
expires: Sat, 26 Apr 2025 14:22:56 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Sat, 26 Apr 2025 01:49:38 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEEdEQ8W_vPKbYx5-HnsvU8A&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame 3458
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEEgmoNxq1DPk54dlElYlaJA&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

189ms
188ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 pubmatic
um.simpli.fi/ Frame 3458 43 B
612 B 436ms
134ms Image
image/gif 34.142.175.23
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.142.175.23 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

23.175.142.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Fri, 25 Apr 2025 01:49:38 GMT
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 7CBE608E-A893-46D0-9F75-2509F212774E
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 3458 43 B
519 B 129ms
96ms Image
image/gif 2406:da18:929:5a00:f230:43e4:a6b:16ef
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/7CBE608E-A893-46D0-9F75-2509F212774E?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2406:da18:929:5a00:f230:43e4:a6b:16ef Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
x.bidswitch.net/check_uuid/ Frame 3458
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5be5cdc9-7606-42b2-a843-8f71bb977d32&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...

43 B
92 B

188ms
188ms

Image
image/gif

35.213.7.90
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.213.7.90 Tokyo, Japan, ASN19527 (GOOGLE-2, US),
Reverse DNS: 90.7.213.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE}
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 3458
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3415881823885830117&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
59 B

194ms
96ms

Image
text/plain

207.65.33.79
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.79 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 26 Apr 2025 01:49:38 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:49:37 GMT
server: nginx

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 3458
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=7CBE608E-A893-46D0-9F75-2509F212774E&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8.3Vpz1E2uUWPC.gP4GXYeU_w2xDi2M-~A&gdpr=0

0
260 B

306ms
96ms

Image
text/plain

207.65.33.76
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8.3Vpz1E2uUWPC.gP4GXYeU_w2xDi2M-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.76 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:49:36 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8.3Vpz1E2uUWPC.gP4GXYeU_w2xDi2M-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: text/html
server: ATS

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 3458
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=2533073041598370076
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Image
text/plain

207.65.33.79
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.79 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 26 Apr 2025 01:49:38 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:49:37 GMT
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 3458
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=4b15c3d30bd70a6b&is_secure=true&networkId=17100&version=1&nuid=7CBE608E-A893-46D0-9F75-2509F212774E&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQACsoiSjnz5lQJ5bZzgAQEBAQEBAQCXbsgx7AEBAQEBAQEB&expiration=1745718578&nuid=7CBE608E-A893-46...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

195ms
195ms

Image
text/plain

207.65.33.79
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.33.79 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 26 Apr 2025 01:49:38 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:49:38 GMT
server: nginx

GET
H/1.1 200
OK 31327
i.liadm.com/s/ Frame 65B5 0
208 B 1222ms
308ms Image
text/plain 52.1.48.82
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aAw7sYsFVXMALOihAO8CPAAA%264795&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.48.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-1-48-82.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Sat, 26 Apr 2025 01:49:39 GMT
trace-id: 42afe4ddb05bcf83
Request-Time: 0
Connection: keep-alive

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 65B5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aAw7sYsFVXMALOihAO8CPAAAErsAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEENSc21gkeO4VLpfUbPYH3E&google_cver=1

43 B
770 B

126ms
124ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEENSc21gkeO4VLpfUbPYH3E&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RIXCeoHg%2BNR%2FZbDOGJlibDswPu4%2BUcrpdL8rr%2BxR7lG0g6ZfEcwb%2Bj3cyK6nzTIaa2LzukwvaOScYyYkQrrxsOYq4XFDDiPfEr8AMFQpzQ00rNdC1oJ%2B78wd6MyNRwFRWHLrB3N2iJRWXA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626cbb3d54865f-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEENSc21gkeO4VLpfUbPYH3E&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 364
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 65B5
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&expiration=1748224178&gdpr=0&gdpr_consent=

43 B
769 B

114ms
113ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&expiration=1748224178&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=le2UJCmXMJs40Mo%2BlTSEkfOxSxvomddPXx5rCSwDl7%2F1RqI9AiNU6SidtMLvt5uZiKIAIVUWOzsJpue6vH%2Bb4moaY7Z1S4%2FYhZYTOwNJMfoY9UULpqj0U4V%2BiCkuEWS%2FO6qWMAeLSCwqWg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626cbb0d41865f-PER
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5be5cdc9-7606-42b2-a843-8f71bb977d32&expiration=1748224178&gdpr=0&gdpr_consent=
content-length: 323
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 65B5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAw7sYsFVXMALOihAO8CPAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1

43 B
766 B

156ms
156ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4f4LbHXHkNOWSAApMKZXs5qDddOlwyclX%2BAKetYKLB%2FsMrzbN8%2FKtGqJEssduQ7W8ETYNYksTZDAHlhHS0VATHatiX4cbGDeACnAhrKQ0i80YxEAbt09Sd6c6dR%2FGtpoEvBXxbc9%2FnX8xA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626cbc7dde865f-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHCpGW9TzcO7jC1Wn7z6tew&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 65B5
Redirect Chain

https://sync.adotmob.com/cookie/indexexchange?gdpr=&gdpr_consent=&r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7Bamob_user_id%7D%26expiration%3D%5BEXPIRATI...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&expiration=%5BEXPIRATION%5D&gdprConsent=

43 B
766 B

114ms
113ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&expiration=%5BEXPIRATION%5D&gdprConsent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WNtfGgD6S5MFcSEPAmlN7E1JjPRhBmBaCUVWl9RUj2I6oqDU7nHc30mvc8Se6Gy0mPqvubppIzzWS4SBw%2B%2FQfg8KmpiQ1mSF44jYOVsNuSrVkL%2Bzx1jr4DAzWw1S6nuvdyXCn%2FoCdYzYMw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626cc1d8ef865f-PER
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&expiration=%5BEXPIRATION%5D&gdprConsent=
keep-alive: timeout=5
content-length: 0
date: Sat, 26 Apr 2025 01:49:39 GMT
x-powered-by: Express
vary: Origin
access-control-allow-credentials: true

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 65B5 42 B
181 B 346ms
101ms Image
image/gif 2406:da18:22e:4f05:f441:8e58:2632:5761
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da18:22e:4f05:f441:8e58:2632:5761 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-transform,public,max-age=300,s-maxage=900
content-length: 42
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Cookie
server: nginx/1.22.1

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 65B5 43 B
855 B 771ms
314ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAw7sYsFVXMALOihAO8CPAAAErsAAAAB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-153-232-128.ap-southeast-2.compute.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: K9PGH6K6PRGD5WN4ZY3J
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 ibs:dpid=23728&dpuuid=aAw7sYsFVXMALOihAO8CPAAA%264795
dpm.demdex.net/ Frame 65B5 42 B
720 B 345ms
121ms Image
image/gif 54.153.232.128
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=aAw7sYsFVXMALOihAO8CPAAA%264795?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.153.232.128 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-apse2-2-v076-0744b4e30.edge-apse2.demdex.com 20 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: dQAPP4mFSFo=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 65B5 43 B
479 B 869ms
311ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=aAw7sYsFVXMALOihAO8CPAAAErsAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 6CNFCWN5DMCHME8GFGKV
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3 200 cm Show response
u.openx.net/w/1.0/ Frame 1CED 684 B
704 B 175ms
169ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: bd9b11021abb9e9a0c3b0f2d885536b3edc31500d9ac94f93b324c66f9936b1b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 684
content-type: text/html
date: Sat, 26 Apr 2025 01:49:37 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.100

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame A981 43 B
479 B 326ms
313ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=0040a100-e1ef-c0ff-2222-d8f89a6cf0af

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: BMAKYCTYYGTM6E63XSEP
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame A981
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOsUd88LqLsl8HKzKtlrDKk&google_cver=1

43 B
61 B

177ms
173ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOsUd88LqLsl8HKzKtlrDKk&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOsUd88LqLsl8HKzKtlrDKk&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame A981 170 B
232 B 235ms
192ms Image
image/png 142.251.221.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzRmOTBlYjctMzQzMi0yNWExLWY3Y2MtMDBkNjM4YmRmNTJm

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame A981
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ae563-Fs5tFuks8AKGbGad7G2M8AAAGWb8kzRA

43 B
61 B

173ms
172ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ae563-Fs5tFuks8AKGbGad7G2M8AAAGWb8kzRA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ae563-Fs5tFuks8AKGbGad7G2M8AAAGWb8kzRA
pragma: no-cache
via: 1.1 30a845a852b74a2965aabbcb6034301e.cloudfront.net (CloudFront)
expires: -1
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: Nx0qUX2lmRjq0GCuCpcBT18AxbLax9eI5QOgePcN3xz2xJJqFIgm_g==
date: Sat, 26 Apr 2025 01:49:39 GMT
x-amz-cf-pop: SYD3-P2

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame A981
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAw7ssCo5swAAJCcEWEAAAAA

43 B
97 B

172ms
170ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAw7ssCo5swAAJCcEWEAAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

Cache-Control: private
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aAw7ssCo5swAAJCcEWEAAAAA
X-SO-LB-Hostname: a-tgng40008.dc2p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"103.108.231.100","key":"aAw7ssCo5swAAJCcEWEAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40258"}
X-SO-Cluster-ID: 0
X-SO-Upstream-ID: a-ad40258
X-SO-HostName: a-ad40258.dc2p.scaleout.jp
Connection: keep-alive
X-SO-IP: 103.108.231.100
X-SO-Key: aAw7ssCo5swAAJCcEWEAAAAA
Content-Length: 0
P3P: CP="See also http://www.scaleout.jp/privacy/"
Date: Sat, 26 Apr 2025 01:49:38 GMT
X-SO-Ads-Time: 4
Server: nginx

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame A981
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=5896dd7d-fd45-7b05-e22c-5a6ff25f3b4f&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=5be5cdc9-7606-42b2-a843-8f71bb977d32&ttd_puid=5896dd7d-fd45-7b05-e22c-5a6ff25f3b4f&gdpr=0&gdpr_consent=

43 B
62 B

175ms
174ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5be5cdc9-7606-42b2-a843-8f71bb977d32&ttd_puid=5896dd7d-fd45-7b05-e22c-5a6ff25f3b4f&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.100
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:49:37 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5be5cdc9-7606-42b2-a843-8f71bb977d32&ttd_puid=5896dd7d-fd45-7b05-e22c-5a6ff25f3b4f&gdpr=0&gdpr_consent=
content-length: 335
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 00E8 43 B
479 B 760ms
319ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=xcweUSSXwnSUkDMuykB7

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: SMJ8PHK0ZYS2WV4X9MZT
Content-Length: 43
Date: Sat, 26 Apr 2025 01:49:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 rtset
bh.contextweb.com/bh/ Frame 00E8 49 B
1 KB 1396ms
281ms Image
image/gif 74.214.196.131
PULSEPOINT

General

Check archive.org

Download Go to Show image

Full URL: https://bh.contextweb.com/bh/rtset?pid=561118&ev=1&rurl=https%3a%2f%2fads.yieldmo.com/v000/sync?userid=%%VGUID%%&pn_id=pp&us_privacy=&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.214.196.131 Sunnyvale, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software: Jetty(12.0.17) /
Resource Hash: d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

cache-control: private, max-age=0, no-cache, no-store
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-stage-0
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-AU
content-type: image/gif;charset=iso-8859-1
server: Jetty(12.0.17)

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 00E8
Redirect Chain

https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?extinit=0&userid=$UID&pn_id=an
https://ads.yieldmo.com/v000/sync?extinit=0&userid=1879256767580541313&pn_id=an

43 B
710 B

96ms
95ms

Image
image/gif

18.142.188.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?extinit=0&userid=1879256767580541313&pn_id=an
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 18.142.188.29 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-142-188-29.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

Redirect headers

cache-control: no-store, no-cache, private
location: https://ads.yieldmo.com/v000/sync?extinit=0&userid=1879256767580541313&pn_id=an
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.100; 103.108.231.100; 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 67a29599-e6d2-405f-be3e-61d6ab02461d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:49:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 00E8
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=xcweUSSXwnSUkDMuykB7
https://ads.yieldmo.com/v000/sync?tdid=5be5cdc9-7606-42b2-a843-8f71bb977d32

43 B
726 B

100ms
92ms

Image
image/gif

18.142.188.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?tdid=5be5cdc9-7606-42b2-a843-8f71bb977d32
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 18.142.188.29 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-142-188-29.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:49:38 GMT
content-type: image/gif;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

Redirect headers

location: https://ads.yieldmo.com/v000/sync?tdid=5be5cdc9-7606-42b2-a843-8f71bb977d32
content-length: 181
date: Sat, 26 Apr 2025 01:49:38 GMT
server: Kestrel

GET sync.php
pixel-us-apac.rubiconproject.com/exchange/ Frame 00E8 0
0

GET
H2 200 /
wt.rqtrk.eu/ Frame 00E8 43 B
350 B 1092ms
354ms Image
image/gif 57.129.18.111
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://wt.rqtrk.eu/?pid=fc4e1fcf-7b7a-41b5-a689-0f1570fe8fea&src=www&type=100&sid=0&uid=xcweUSSXwnSUkDMuykB7&cb=1745632178118&url={{REFERRER}}&gdpr=0&gdpr_consent=
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 57.129.18.111 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: haproxy-eu-013.roqad.pl
Software: istio-envoy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

cache-control: no-cache,private
pragma: no-cache
x-envoy-upstream-service-time: 1
expires: Sat, 26 Apr 2025 01:49:38 GMT
content-length: 43
p3p: CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
date: Sat, 26 Apr 2025 01:49:39 GMT
content-type: image/gif
server: istio-envoy

POST
H3 204 AGSKWxXc9I2SiTCWG5_1El06zO7IUNsdc4-8Nu7PKpPoPtOgwWFSVCw8RczIsA8PxpfmlWFwa3He8Eyn19XuXON2oj4vavnZvgmq9vaAJSINBwCykjy-MtIlPpl_T607G60rjBNCpqYibw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 210ms
205ms XHR
text/html 142.251.221.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXc9I2SiTCWG5_1El06zO7IUNsdc4-8Nu7PKpPoPtOgwWFSVCw8RczIsA8PxpfmlWFwa3He8Eyn19XuXON2oj4vavnZvgmq9vaAJSINBwCykjy-MtIlPpl_T607G60rjBNCpqYibw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.221.78 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS