paint.toys Open in urlscan Pro
15.197.167.90 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qwxz.avasporelight.com/gttycnnfnaftmyoqjbcsafrmoclecjRdGloVWlOWE1PSlU5S0l5VzhzbjctMjY5MC0yNjcxNTk3MS0xMDA3MDI3OC0zODM2LW5VaVRXd2R0eExBQjZCdGl3UUZy/774ska3lc1jirm9ezu647utwepgmwj9qn/uqyvrd/vi0vpwevtgbcl
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 23764
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Sat, 26 Apr 2025 01:50:14 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JSQWKF6Y3TXXGKWD91FB5ATC

Redirect headers

accept-ranges: bytes
age: 25489
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1645
content-type: text/html; charset=UTF-8
date: Sat, 26 Apr 2025 01:50:14 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JSQWKF40F8NZS4FQHQRSXE3P

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 171ms
99ms Script
application/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7be1c6da402153304c6fe3beb0c2661e03601b02c4323236439c1d8d77477fea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 93626d9bccba8dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 62ms
59ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 857
accept-ranges: bytes
content-length: 1392
x-nf-request-id: 01JSQWKF931Q9VY6MAP1Y5TE7G
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 89ms
86ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 23764
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JSQWKF9YEGZ89GC7QXXMQTXW
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 95ms
93ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 857
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JSQWKF9YEQK5QYSMXGAE81Y6
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 88ms
86ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 857
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JSQWKF9ZGJGZDS7R27EWD7QK
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 65ms
62ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 857
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JSQWKFC01RP124JBGZX8N6AW
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 74ms
71ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 857
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JSQWKFCFY2931WTPSYM44JQW
cache-status: "Netlify Edge"; hit
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 65ms
63ms Script
application/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 714718ea2599ed1cdc2b97ccd12877b62944edff11303666e8ff344981b4a13c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 93626d9becec8dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 366 KB
123 KB 290ms
94ms Script
application/javascript 172.253.122.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

6562d8bad7f1432db407c491bd4d6931780fa30c9a3fcc452e52f2ac0abfbb56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
expires: Sat, 26 Apr 2025 01:50:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
content-length: 125219
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ca6bde09737649d_4398cbb3d2db528f5cbb.v1.js Show response
faucetfoot.com/static/3160c21523d58/ 68 KB
25 KB 220ms
49ms Script
text/javascript 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/static/3160c21523d58/ca6bde09737649d_4398cbb3d2db528f5cbb.v1.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

421f8480ec889a3b90f5b0e008abd1fb1c5cead03709c3ceb41cdc4c4292d979

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"33e0c970d348574e4afc5d699c9c0e5cd39ae139cfa737f3ac2187decea5b098"
via: fen-hoothoot-us-east1-test-k040.gce-us-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 227ms
67ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5516160f534b4cd75900f7c2b09f9905c71098ba21bf94b515717a7f53c4a75b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 324 / 20204 / m202504220101 / config-hash: 18116493962408344416
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 01:50:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33892
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 54ms
53ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 5644
cf-ray: 93626d9c8d998dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 411 B
336 B 65ms
64ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cbab43d2db3b77efdbf5cae66c7f8e202c70b3c136237f4f977bef40d86507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a2f607b2abbb34303d7b9531c1a9ebcc"
age: 6955
cf-ray: 93626d9d0e448dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.816717f0fefdba312f2f.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
2 KB 68ms
63ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faa04735dd36414ea1be1f8e0ecce4c41f47ccc65c94e754c4073e1f6a59c115

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"cd64d4c5fb9e686de5a9d31f5c6e1020"
age: 6953
cf-ray: 93626d9d8f098dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.25cd0c88862d62596ad5.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 462 KB
140 KB 82ms
77ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f0fb98629bdcde55be36d3852ea70d065674c404f1c63380b750816c5050720

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a83125d38dc322a379d22cc11148e4b4"
age: 6953
cf-ray: 93626d9d8f0b8dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 329ms
151ms Image
image/gif 3.171.85.68
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?service=ad&adid=yjvbku&adnum=800322
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.85.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-85-68.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 33104
x-cache: Hit from cloudfront
x-amz-cf-id: AQQjTSM7PDUzqmeyMDgX8uax2gdt2bgfSaWKyrxNlGatOaghZ7Gn6A==
date: Fri, 25 Apr 2025 16:38:32 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 8bfd81930b924398beafec91f36dd63c.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/ 529 KB
167 KB 52ms
51ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

cdn-185-199-110-133.github.com

Software

cafe /

Resource Hash

0a18f1d1a038a61a76a04b783020b0f52bcd997b4b83015b566a8f3e9093c2e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4745022393092336697
age: 29659
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 17:35:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 25 Apr 2025 17:35:55 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170786
x-xss-protection: 0
server: cafe

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 559 B
444 B 46ms
46ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 6892
cf-ray: 93626d9ec8ef8dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 9204 503 B
427 B 173ms
53ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 6952
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93626d9fafe6b4aa-MIA
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:50:15 GMT
hw-country-code: US
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 2B4E 503 B
0 171ms
171ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 6952
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93626d9fafe6b4aa-MIA
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:50:15 GMT
hw-country-code: US
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/21/desktop/Chrome/ 583 B
920 B 276ms
123ms XHR
application/json 99.84.188.33
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Fri/21/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.188.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-188-33.iad89.r.cloudfront.net
Software: CloudFront /
Resource Hash: 4e8749bf7ee8ff275a98853e3c8fae3bc72fad11f842a23e2db29e05560a0dd1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 3002
via: 1.1 5bbbde7889bb9c7247f5924a32d2fdf0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 583
x-amz-cf-id: FsPISaGUPvr6rXjD8Xe9QYXeoyhmJ6Lh719Tp3Z4-7KVRU5ZR9ThXw==
date: Sat, 26 Apr 2025 01:00:13 GMT
content-type: application/json
x-amz-cf-pop: IAD89-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 150 KB
39 KB 122ms
39ms Script
application/javascript 104.22.74.216
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.74.216 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8545960ff64a63492ec5697a7ad530029d5b1ed616dfb381ab4e24e32cdf763

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "729091b4a235c6f5248e31a198c358b1"
via: 1.1 google
cf-ray: 93626d9f88bce00f-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39874
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: application/javascript
last-modified: Sat, 26 Apr 2025 01:45:41 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 358 KB
86 KB 219ms
64ms Script
application/javascript 13.249.41.182
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.41.182 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-41-182.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3e7cec086c6f1c8c57de8561ce5bb8488e68b27391b0d6e8fb0ee471b9de187f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"4173e93caf83178c49bea9e2ca115e00"
age: 781
via: 1.1 24eb88cb96b9676eb6757c142361d0e2.cloudfront.net (CloudFront), 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: wgOoq7bIlwW98NLwHHYpPlAh8mmyPuy11VWtYFzMt8k1ftFgWfX_gA==
date: Sat, 26 Apr 2025 01:37:15 GMT
content-type: application/javascript
last-modified: Mon, 21 Apr 2025 17:15:46 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, IAD89-C1
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
591 B 164ms
82ms Image
image/gif 185.199.110.133
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.110.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 706dcd680c79a847150877cb03a72319585de940
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: FC7F:1601EE:20EE5C:282EC3:67ED4345
expires: Sat, 26 Apr 2025 01:55:15 GMT
x-cache: HIT
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: image/gif
x-served-by: cache-mia-kmia1760060-MIA
x-cache-hits: 24
source-age: 192
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1745632215.023371,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 240ms
86ms Script
text/javascript 3.167.69.77
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-77.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 68759
via: 1.1 a04e8c97f1e289e082ffa9503a1e95d0.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: OUvzk71i6A6DVuw49hlhg_NEYs3iLey-up2wgwo9e-7wmkW2OJWLpQ==
date: Fri, 25 Apr 2025 06:44:17 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
109 KB 78ms
75ms Script
application/javascript 172.253.122.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54n0h1v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

25d4a8ebfb391a304a834b1dba3244df6d3138c59d86e3a52a3ea9aca5977419

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
expires: Sat, 26 Apr 2025 01:50:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
content-length: 111318
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 261ms
144ms Fetch
text/plain 64.233.180.139
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54n0h1v9101576445za200&_p=1745632214296&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&cid=1356630277.1745632215&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745632214&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.avasporelight.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1832
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.233.180.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: on-in-f139.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 200 KB
65 KB 252ms
134ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fa735fddfb429eb527ce339c8e25f05b7e39e66e5bff17f85b85be9e6291178d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-u9OZSgihrAevEe59Fkk5KA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw0JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GRds_EW61YgbtK-zdoFxELcHNe_bzjAJvBizvpsJY2k_ML45Py8kqLMpNKS_KK05LTU4tSistSieCMDI1MDEyMTPQOD-AIDAF2hO7U"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-u9OZSgihrAevEe59Fkk5KA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 9204 17 KB
7 KB 42ms
41ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 6953
cf-ray: 93626da0296bb4aa-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 2B4E 17 KB
0 35ms
34ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 6953
cf-ray: 93626da0296bb4aa-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 152ms
56ms Image
image/gif 104.22.4.65
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 877965
x-goog-stored-content-encoding: identity
expires: Sun, 27 Apr 2025 01:50:15 GMT
x-goog-stored-content-length: 43
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItMCvSVCm2SjnKS_2I9dAZcqO8fiUkxqBSaDsXVqMv6RsBuLRj3FTBSRfzdscHQn4on
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 93626da0daed07ba-MIA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 116ms
58ms Image
image/x-icon 142.250.31.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 47894
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 12:32:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 25 Apr 2025 12:32:01 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
624 B 152ms
57ms Image
image/gif 104.22.4.65
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.3241124959652435
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 877965
x-goog-stored-content-encoding: identity
expires: Sun, 27 Apr 2025 01:50:15 GMT
x-goog-stored-content-length: 43
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItMCvSVCm2SjnKS_2I9dAZcqO8fiUkxqBSaDsXVqMv6RsBuLRj3FTBSRfzdscHQn4on
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 93626da0daf007ba-MIA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 126ms
124ms Fetch
text/plain 64.233.180.139
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54n0h1v9102396898za200zb9101576445&_p=1745632214296&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103130498~103130500~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&cid=1356630277.1745632215&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745632215&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqwxz.avasporelight.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1745632214296&tfd=1968
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54n0h1v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.233.180.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: on-in-f139.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/plain
server: Golfe2

GET 791b06ba-dbba-4bc7-8b02-9e7ef7608d9b
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 250ms
133ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 26 Apr 2025 01:50:15 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 200097
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 86ms
43ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 22223
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745524555&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=ceDKXNa7tmF6wMLc4%2FD42N0kznZxMqlSFAavm43vcAs%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Thu, 24 Apr 2025 19:55:55 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745524555&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=ceDKXNa7tmF6wMLc4%2FD42N0kznZxMqlSFAavm43vcAs%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 93626da11cc41670-MIA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
1 KB 45ms
43ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 6952
cf-ray: 93626da0db9e8dd0-MIA
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 228ms
82ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/gttycnnfnaftmyoqjbcsafrmoclecjRdGloVWlOWE1PSlU5S0l5VzhzbjctMjY5MC0yNjcxNTk3MS0xMDA3MDI3OC0zODM2LW5VaVRXd2R0eExBQjZCdGl3UUZy/774ska3lc1jirm9ezu647utwepgmwj9qn/uqyvrd/vi0vpwevtgbcl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 37bfbccaf6693d92306827d6cffff546ac63de5df8c0ff64f03c7a880bfe5cac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 444 KB
141 KB 226ms
104ms Script
text/javascript 172.253.115.95
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f95.1e100.net

Software

cafe /

Resource Hash

f2df469bf671e611a21b132334f159ce53644f1f6acf75f5fc54e3f3faead4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5159063225277301318
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 01:50:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 143605
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 610ms
273ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-84-72-103.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
777 B 345ms
197ms Fetch
application/json 54.159.219.206
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.159.219.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-219-206.compute-1.amazonaws.com
Software: /
Resource Hash: e485da43317f6aa25424ade9f6ff69051af7dd5e963c8a7ee5312072d7aeb4db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 130 B
664 B 311ms
122ms Fetch
application/javascript 52.201.17.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.17.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-17-141.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: b0c17474db432b31b5087e12e96d5c6c744aaf765f20fe0aa225b3ce90c14bca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 154ms
58ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7202e8ffd0037bf677c0a549c4f1c06d867b25581b22d18d77be35e14c6804a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 483 B
895 B 235ms
88ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jsqwkg4fv758ht6k8dv2792d&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ab5ca1f3eb952518a00dadfd3a427081101f11cf608e07bb354331e6baabb279

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 6084d1d15d8e8acb
request-time: 4
access-control-allow-credentials: true
expires: Sun, 27 Apr 2025 01:50:15 GMT
access-control-allow-origin: https://paint.toys
content-length: 483
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 352 B
939 B 257ms
123ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fdf32197df9eabf0a288b480deb4c6d6fafa7ff6e28fb0f903d5633ac27b8632

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 402696
expires: 0
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:14 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_ac207783-c8e0-45ac-8b0f-4b3272ecd43b_1745632215147
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfYWMyMDc3ODMtYzhlMC00NWFjLThiMGYtNGIzMjcyZWNkNDNiXzE3NDU2MzIyMTUxNDcQABoNCNf3sMAGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=c5eddc52bbefdf6e5ba3720043abe7668640259c31a02e235d15ed3e3bc4f6cf791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c5eddc52bbefdf6e5ba3720043abe7668640259c31a02e235d15ed3e3bc4f6cf791426b5417dce21&rand=02351383
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c5eddc52bbefdf6e5ba3720043abe7668640259c31a02e235d15ed3e3bc4f6cf791426b5417dce21&rand=02351383&expected_cookie=e8bc1db5-7afe-4f40-ba2f-0933b3d56ab4

0
144 B

132ms
132ms

Image
text/plain

150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c5eddc52bbefdf6e5ba3720043abe7668640259c31a02e235d15ed3e3bc4f6cf791426b5417dce21&rand=02351383&expected_cookie=e8bc1db5-7afe-4f40-ba2f-0933b3d56ab4
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: BC679A5CCBAB4396BD02F7A65B072078 Ref B: MIA301000103027 Ref C: 2025-04-26T01:50:16Z
x-li-fabric: prod-lor1
x-li-uuid: AAYzpKwmMxQ7hJa1JJ7Bkg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Apr 2025 01:50:15 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: /db_sync?pid=10339&puuid=c5eddc52bbefdf6e5ba3720043abe7668640259c31a02e235d15ed3e3bc4f6cf791426b5417dce21&rand=02351383&expected_cookie=e8bc1db5-7afe-4f40-ba2f-0933b3d56ab4
x-msedge-ref: Ref A: B448FC30B0964B90A7BBD84B80556403 Ref B: MIA301000103027 Ref C: 2025-04-26T01:50:15Z
x-li-fabric: prod-lor1
x-li-uuid: AAYzpKwkSWxVxj9V0zT9jg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Apr 2025 01:50:15 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_ac207783-c8e0-45ac-8b0f-4b3272ecd43b_1745632215147
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_ac207783-c8e0-45ac-8b0f-4b3272ecd43b_1745632215147

1 KB
2 KB

59ms
59ms

Script
application/javascript

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_ac207783-c8e0-45ac-8b0f-4b3272ecd43b_1745632215147
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: 1334816543b28f6a27055297019b58bf4f0bb11101c92216aed22ef0b42e1eb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:50:15 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_ac207783-c8e0-45ac-8b0f-4b3272ecd43b_1745632215147
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:50:15 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 253ms
114ms XHR
application/javascript 13.249.41.182
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.41.182 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-41-182.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 5715
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: 9WNt0cZ4NV1mWYDFpaajHiVUH0gSA4ooZLXO2B6VrJitM2vsGGCC7g==
date: Sat, 26 Apr 2025 00:15:01 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD89-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 396ms
108ms Script
application/javascript 18.160.10.101
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-101.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 2623
via: 1.1 b9e3ae23b2e5d7b2e1c159467ba23f34.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: hMmJ27xKJlEl77ho11aFi8TEEn8GY-BNzxpA2eKKJ5sLV60aukMMwA==
date: Sat, 26 Apr 2025 01:06:32 GMT
content-type: application/javascript
x-amz-cf-pop: IAD12-P3
server: CloudFront

GET config
c.amazon-adsystem.com/cdn/prod/ 0
0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 826 B
724 B 714ms
446ms Fetch
application/json 3.171.83.184
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqwxz.avasporelight.com%2F&pid=UUi62qmYJZWGo&cb=0&ws=1600x1200&v=25.414.1933&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=4ca4b4b3-3e3b-428f-978c-29eb80721742&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.83.184 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-83-184.iad89.r.cloudfront.net
Software: Server /
Resource Hash: 951d359d35b9e41fab624f3d08ed459fcdd28d01c38484d17ff98f33182b67c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 7f7d9243d958ecc0cb433b766a106f4c.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 393
x-amz-cf-id: rDQdy9i_IMSu36UpkEmOo0Sotye9jGF8PyiDfMvCJBLFh4Mqm2Es3w==
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD89-P3
server: Server

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 394ms
150ms XHR
application/json 3.224.96.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.96.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-96-149.compute-1.amazonaws.com
Software: /
Resource Hash: 43b5f98f3e8fd1ee67851560c85a39e130619898d847599a3b4c9fe97992fb54

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=utf-8

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504240101/ 63 KB
23 KB 57ms
56ms Other
text/plain 142.250.31.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504240101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

02b8824bd47ff5abde631d5dad8206e74bf7aea212f3873eda3c9dfb37d1fcea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17736166072191226177
age: 29661
x-content-type-options: nosniff
expires: Fri, 02 May 2025 17:35:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 25 Apr 2025 17:35:54 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23361
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504240101"

POST
H3 200 9d159fdbd24e62d137f8193e2e31c94249791b76df0d204609798bcc69c80d0a94 Show response
faucetfoot.com/0/ 295 B
319 B 114ms
57ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/0/9d159fdbd24e62d137f8193e2e31c94249791b76df0d204609798bcc69c80d0a94

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/static/3160c21523d58/ca6bde09737649d_4398cbb3d2db528f5cbb.v1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

7ff021ee2506ad0b103cde72d90c1197c141ccedc455c1ea1dc69b504f1d02a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-test-k040.gce-us-east1, 1.1 google
expires: Sat, 26 Apr 2025 01:50:14 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame C984 1 KB
2 KB 239ms
28ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1415
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:26:40 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwoWNwusr-zb0Efr_p2F-yKWhdRIeqHBqIf08iof-_qpMbSF8iANNQc5bEWO0kyxl3w

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 4FD3 2 KB
1 KB 276ms
66ms Document
text/html 23.54.45.11
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.45.11 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-45-11.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=172397
content-encoding: gzip
content-length: 859
content-type: text/html
date: Sat, 26 Apr 2025 01:50:15 GMT
expires: Mon, 28 Apr 2025 01:43:32 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 117ms
71ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17db58a47499520b82d341ba12b8c31dff5dba9a2595600c54fd8e0125d7a04b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632215&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ROdB7AfbwGGjoLMu6P90%2FLLAtOwJ2grhdojJvq6y55k%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632215&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ROdB7AfbwGGjoLMu6P90%2FLLAtOwJ2grhdojJvq6y55k%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 93626da23d20b7d3-MIA
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 430 B
959 B 374ms
334ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c94021f9508783898c12f526d6ee21c07ce32dd59cb986ae55f461f94b3c0d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632215&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ROdB7AfbwGGjoLMu6P90%2FLLAtOwJ2grhdojJvq6y55k%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632215&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ROdB7AfbwGGjoLMu6P90%2FLLAtOwJ2grhdojJvq6y55k%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 93626da23d1cb7d3-MIA
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 860 B
870 B 334ms
197ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 457f9a4e1aa9deed2086460e3fba5be4117978dc88b280225ea67b0c3dd49654

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=idRmFEodOLcS0os7ktqDoRQKt0eYd21ak7FAuWRx7zH6nrzTJgLPQKGPDcyD8JuBpb56VC0z0bQ19n5AGcVdbxlbft0UTjB0qOH5fp2zZ%2BzeoKOH6Eh4PgKwv38wPMO3w0%2Bx1r59"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93626da2fed27b6f-MIA
access-control-allow-origin: https://paint.toys
content-length: 240
server: cloudflare

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
360 B 2639ms
2491ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: e7e34715f2bbda1c388d52d6d2538dd1c9134e010f6badb2eaa02f6ceeef0977

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 146.70.45.122
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: text/plain
vary: Origin

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 514ms
352ms Fetch 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:50:15 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 459ms
293ms Fetch 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:50:15 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 536ms
375ms Fetch 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:50:15 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 430ms
258ms Fetch 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 26 Apr 2025 01:50:15 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 327ms
165ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:15 GMT
server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
622 B 308ms
145ms Fetch
application/json 3.167.112.98
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.112.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-112-98.iad55.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 2d87719e07178836cf28676786b8b11c86c170ba69e3c2decd4876693468fc6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 018bc8ac3ac3155b3d0b36b861811052.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: yubG8SGLVC6_pDhf_atvHrb2jyaJaZ9xe2_bXFSO5ULgdWaCjSFYnA==
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
x-amz-cf-pop: IAD55-P8
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 231ms
71ms Fetch
application/json 34.236.95.104
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632215368&to=600&aun=pw-160x600_atf&pubcid=b5ff3c34-ec31-4103-84ea-de1cd38ea611&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=572a1df0-bfd9-40ca-8b62-64ff3279f188&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.95.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-95-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 229ms
73ms Fetch
application/json 34.236.95.104
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632215369&to=600&aun=pw-160x600_btf&pubcid=b5ff3c34-ec31-4103-84ea-de1cd38ea611&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=08e1c988-71e5-44d3-8499-4c3626ed685b&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.95.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-95-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 228ms
72ms Fetch
application/json 34.236.95.104
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632215369&to=600&aun=leaderboard_atf&pubcid=b5ff3c34-ec31-4103-84ea-de1cd38ea611&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=52b03eb0-c6a3-4e23-bad9-99e718c47278&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.95.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-95-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 228ms
73ms Fetch
application/json 34.236.95.104
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745632215369&to=600&aun=leaderboard_btf&pubcid=b5ff3c34-ec31-4103-84ea-de1cd38ea611&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=bb56f1bb-d0b8-4c10-9900-a84ada17bd63&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.95.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-95-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 484 B
2 KB 484ms
245ms Fetch
application/json 68.67.160.132
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

1bf6383c62c12c5668bd33804cf1082c176ada99270da839db93d79a8821e998

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.45.122; 146.70.45.122; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: b91c3131-7a83-48cb-9fa4-c1927b1094c9
content-length: 484
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:15 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 691 B
1 KB 381ms
227ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=e4686084-ac78-403f-9c52-db7608513bb3&l_pb_bid_id=98ab6765a1f7feb8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=572a1df0-bfd9-40ca-8b62-64ff3279f188&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.9162387979799782
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 9dbde867ee8e766b3d89dc1212589b57509dce6b661e643c200636cbd53a7da9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 523 B
862 B 325ms
171ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=e4686084-ac78-403f-9c52-db7608513bb3&l_pb_bid_id=9932eb74bd741118&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=08e1c988-71e5-44d3-8499-4c3626ed685b&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.3104360503425908
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: f5d656f85fd198506346d6fc742aeab15074fac1e79d7fd595e6e7e25c78946d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 523
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 529 B
869 B 253ms
100ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=e4686084-ac78-403f-9c52-db7608513bb3&l_pb_bid_id=1001212f1173d598&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=52b03eb0-c6a3-4e23-bad9-99e718c47278&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.13748193717491908
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 0d49bbeed7fc59af28e9d14d8dc28a1241cbeb9178c12ffa89708a8c55c8d387

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 529
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 529 B
1 KB 229ms
76ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=e4686084-ac78-403f-9c52-db7608513bb3&l_pb_bid_id=101be42db3d769dd8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=bb56f1bb-d0b8-4c10-9900-a84ada17bd63&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.29995464905522595
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: f20df6ae5afcef8e5bf23f3f934321050cd7d32d292b2f1abaddaef94823c023

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 529
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 329ms
93ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
853 B 258ms
84ms Fetch
application/json 3.233.183.24
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.183.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-183-24.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-auction-status: 29, 29, 29, 29
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 26 B
313 B 366ms
211ms Fetch
application/json 74.119.117.5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

91f2ddc749fee8ed97764839c0c05975c92e4ad9980427f1bb162ab70309e4a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
462 B 341ms
172ms Fetch 74.119.117.12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=22832421470&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:14 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 17 KB
9 KB 587ms
441ms Fetch
application/json 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c33900d01474cbb45cf26508c3483b0c3446c9951d949a239bb8ee57fbe1e3ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 93626da32bfe02dc-MIA
expires: 0
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 705 B
800 B 347ms
204ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

bbac6d60e836842a7eea7104d64368baf8bb8af35fe93e15a11513ba7859cb6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 444
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 544 B
722 B 348ms
205ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ec35267bc4e310515ff30117d3a4dbfcfda583fbc3d7d77f065cb637d1d5ab5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 366
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 651 B
772 B 286ms
144ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

4975e61809884c7df9cd7cd0313ab29d196d2fa88e8633ba8f6ccc0db72006e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 415
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 443 B
650 B 319ms
178ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6c2db048b4485b892bab0d2d9c6ce6b501ed3cdc04a99aad086c4b11c5579db4

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 294
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

GET
H2 200 AGSKWxXYkq3oq7q8SwsxODp_-3UkacWx7LrQPae_ppq5-PbHpA7T6JR8NIcRiTjIEkow7Js0cePviQ8_gVHcuIN4biCULAO5h5B90iuR9Q4k6giG79o2HCTjGmRnEJQDTjh6ZdEsnEmyHg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 116ms
115ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXYkq3oq7q8SwsxODp_-3UkacWx7LrQPae_ppq5-PbHpA7T6JR8NIcRiTjIEkow7Js0cePviQ8_gVHcuIN4biCULAO5h5B90iuR9Q4k6giG79o2HCTjGmRnEJQDTjh6ZdEsnEmyHg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjMyMjE1LDQ3MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJpQ1hMZFVyOW4wVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmF2YXNwb3JlbGlnaHQuY29tIl0sWzI1LCJbWzk1MzQwMjUyLDk1MzQwMjU0XV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.iCXLdUr9n0U.es5.O/d=1/rs=AJlcJMwSEyvXofDNu5qDly3KLGW1OQt1zg/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dafe4f7c7d4f87ae92ba8cd3e46ebe63d14e99eda46a97614817b222207ba1a9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-XFJ1Mx5T_LATwMfqCK1_7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GRds_EW61YgbtK-zdoFxEI8HNe_bzjAJjBh0pNOJiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxMjEz0Dg_gCAwCJvDus"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-XFJ1Mx5T_LATwMfqCK1_7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 18C4 101 KB
28 KB 112ms
57ms Document
text/html 142.250.31.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-3-167-37-61.iad61.r.cloudfront.net

Software

sffe /

Resource Hash

190f676ee781e35d2d2a8c07e56b2ca05fe36625bbc7a5cfec2f3a060a45c3e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1135
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28980
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:31:20 GMT
expires: Sat, 26 Apr 2025 02:21:20 GMT
last-modified: Mon, 21 Apr 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 268ms
114ms Script
application/javascript 3.167.37.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.167.37.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 366
x-cache: Hit from cloudfront
x-amz-cf-id: GljZMEMaUd2SKsOffWQaa9Vmtn7t2XvlPMS_W6Yglsxa3s0THnfGRg==
date: Sat, 26 Apr 2025 01:44:10 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 43ea6d4d093c6f8fb9edddca6fa0cf36.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: IAD61-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 133ms
34ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 627833
x-goog-stored-content-encoding: gzip
expires: Sat, 18 Apr 2026 19:26:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Fri, 18 Apr 2025 19:26:22 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyIt9RHnP2Nur5lFm72IQsXN_0YS2cyy8LThPveHHTnVW99R5VeYdREUECxxIbghRRD_R
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 285ms
155ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: c361a51e238eb3119e7df18108bf1b10

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 170ms
41ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 23818
cf-ray: 93626da3aee5c77b-MIA
expires: Tue, 29 Apr 2025 01:50:15 GMT
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 252ms
106ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Sun, 27 Apr 2025 01:50:15 GMT
access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 260ms
132ms XHR
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 268ms
122ms XHR
application/json 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame B08A
Redirect Chain

https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gd...
https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx...

943 B
1 KB

53ms
49ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: b20e102b426f06ebcef68f3e947f687988edb188b78419bfe5b62f38feed5022

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 943
content-type: text/html
date: Sat, 26 Apr 2025 01:50:14 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 146.70.45.122

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Sat, 26 Apr 2025 01:50:15 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 146.70.45.122

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 267ms
121ms XHR
application/octet-stream 100.27.136.39
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.27.136.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-27-136-39.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H3 200 AGSKWxUu4fRsJZonq0HNk9AQ7R5HTnGCNWF4rWQMYE75a7NX9N0fjOGXRcFBW1IA0BM9QSTjxBSrHXbxMO-mF4ACmtBv8jR0tIdARWzReSm8NlJr64QHHBqrobIpPG4e_yJg1e-FuFHesg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 108ms
107ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUu4fRsJZonq0HNk9AQ7R5HTnGCNWF4rWQMYE75a7NX9N0fjOGXRcFBW1IA0BM9QSTjxBSrHXbxMO-mF4ACmtBv8jR0tIdARWzReSm8NlJr64QHHBqrobIpPG4e_yJg1e-FuFHesg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjMyMjE1LDYzNjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiaUNYTGRVcjluMFUiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXd4ei5hdmFzcG9yZWxpZ2h0LmNvbSJdLFsyNSwiW1s5NTM0MDI1Miw5NTM0MDI1NF1dIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

51dae76faa1c53151780ecc7cf6a4dd04b03b3eeb48b1dfa2f7795de031fe087

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-joS5rv7g6unBKL5LP_dDMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmII0pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GRds_EW61YgbtK-zdoFxEI8HNe_bzjAJnCiffclJiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxMjEz0Dg_gCAwCflTwI"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-joS5rv7g6unBKL5LP_dDMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MjRRRVpvdHQxdlFYN1NCYlR1bEx6cHBDWmxfVU9UcVhwUzRWNzFNcHBRZUU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MjRRRVpvdHQxdlFYN1NCYlR1bEx6cHBDWmxfVU9UcVhwUzRWNzFNcHBRZUU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESENzfHRBwqzh6CDgr9Bchm8A&google_cver=1

70 B
440 B

151ms
56ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESENzfHRBwqzh6CDgr9Bchm8A&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:50:16 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESENzfHRBwqzh6CDgr9Bchm8A&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Sat, 26 Apr 2025 01:50:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=65fb7569-4cd6-4735-aeff-0f62732eac0e&bid=1e2n4ou

70 B
440 B

104ms
55ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=65fb7569-4cd6-4735-aeff-0f62732eac0e&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:50:16 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=65fb7569-4cd6-4735-aeff-0f62732eac0e&bid=1e2n4ou
content-length: 191
date: Sat, 26 Apr 2025 01:50:16 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-kfDeBZxE2pUK2AxVofKsfmUTJL4gGeSGCHM-~A&gdpr=0

70 B
440 B

205ms
127ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-kfDeBZxE2pUK2AxVofKsfmUTJL4gGeSGCHM-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:50:16 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-kfDeBZxE2pUK2AxVofKsfmUTJL4gGeSGCHM-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3082627009787008950&newuser=1&referrer_pid=m51mh00

70 B
440 B

81ms
55ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3082627009787008950&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:50:16 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3082627009787008950&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 26 Apr 2025 01:50:11 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=280266010643178489&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

56ms
55ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=280266010643178489&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 26 Apr 2025 01:50:15 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=280266010643178489&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.45.122; 146.70.45.122; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 5dc9701c-289a-4e7a-9adb-0a3cd514357f
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:15 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 j Show response
rp.liadm.com/ 13 B
379 B 272ms
124ms Fetch
application/json 54.197.251.116
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp.liadm.com/j?dtstmp=1745632215686&did=did-0046&se=e30&duid=8e413bd09c43--01jsqwkg4fv758ht6k8dv2792d&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqwxz.avasporelight.com%2F&cd=.paint.toys
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.197.251.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-197-251-116.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 4bfd01cf-5cb0-4b2e-99ca-8ff36950203d
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 13
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame DA3F 16 KB
7 KB 238ms
106ms Document
text/html 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:50:15 GMT
server: Kestrel
server-processing-duration-in-ticks: 686131
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 200 setuid
prebid.intergient.com/ Frame B08A 0
829 B 150ms
114ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=6d2de286-c8dc-436b-98d7-90da4f51fe38
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632215&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ROdB7AfbwGGjoLMu6P90%2FLLAtOwJ2grhdojJvq6y55k%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632215&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ROdB7AfbwGGjoLMu6P90%2FLLAtOwJ2grhdojJvq6y55k%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93626da4d911347f-MIA
server: cloudflare

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B08A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFOUO76Plr8-MdxlCnlPjFU&google_cver=1

43 B
61 B

44ms
44ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFOUO76Plr8-MdxlCnlPjFU&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFOUO76Plr8-MdxlCnlPjFU&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Sat, 26 Apr 2025 01:50:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame B08A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Nzg5Y2JlODMtYjgzNC0yZTI2LWU2YmItMGE3NjA0ZThmMmQ1
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Nzg5Y2JlODMtYjgzNC0yZTI2LWU2YmItMGE3NjA0ZThmMmQ1&google_tc=

170 B
243 B

97ms
96ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Nzg5Y2JlODMtYjgzNC0yZTI2LWU2YmItMGE3NjA0ZThmMmQ1&google_tc=

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:50:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Nzg5Y2JlODMtYjgzNC0yZTI2LWU2YmItMGE3NjA0ZThmMmQ1&google_tc=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Sat, 26 Apr 2025 01:50:15 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B08A
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=54f36d49-7143-7082-f35b-50cfce0a3cb5&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=54f36d49-7143-7082-f35b-50cfce0a3cb5&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=49c3faef-6035-48d8-870a-95c452414c25&ttd_puid=54f36d49-7143-7082-f35b-50cfce0a3cb5&gdpr=0&gdpr_consent=

43 B
62 B

44ms
43ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=49c3faef-6035-48d8-870a-95c452414c25&ttd_puid=54f36d49-7143-7082-f35b-50cfce0a3cb5&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=49c3faef-6035-48d8-870a-95c452414c25&ttd_puid=54f36d49-7143-7082-f35b-50cfce0a3cb5&gdpr=0&gdpr_consent=
content-length: 335
date: Sat, 26 Apr 2025 01:50:16 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame B08A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/c0340b0d-e1ef-e2cb-c28c-463a315df1fc?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-y5lVEWdE2p_XH51RZchXAU2yW3JLZq4iWCQ-~A

43 B
136 B

54ms
44ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-y5lVEWdE2p_XH51RZchXAU2yW3JLZq4iWCQ-~A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-y5lVEWdE2p_XH51RZchXAU2yW3JLZq4iWCQ-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 26 Apr 2025 01:50:15 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame B08A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAw72AAMukfXRwBh

85 B
171 B

181ms
180ms

Image
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAw72AAMukfXRwBh
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1745632216.279973,VS0,VE0
age: 1788
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: image/png
x-served-by: cache-mia-kmia1760052-MIA
server: Jetty(9.4.35.v20201120)
x-cache-hits: 8724

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aAw72AAMukfXRwBh
x-timer: S1745632216.162818,VS0,VE27
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Sat, 26 Apr 2025 01:50:16 GMT
x-served-by: cache-mia-kmia1760052-MIA
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame B08A
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3939934405842465097&gdpr=0&gdpr_consent=&us_privacy=

43 B
97 B

82ms
82ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3939934405842465097&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3939934405842465097&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 26 Apr 2025 01:50:26 GMT

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
705 B 88ms
84ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: b22928f7b532a0573fde9ef7177725178b38149e9559c9e67b482299a965b373

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 86ms
82ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 85ms
81ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 85ms
82ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 258ms
152ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: c080e34867f3b069dd1b2ea27985d77e994b3461ff7ab59123a82ec7a0231f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json
x-cloud-trace-context: d11620636d53c7bf06d81dd3b55c5958
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 634ms
275ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

3306b031682bd07ca2f5ea61b61e6a6821755dedbcb7c8b499a81d802893ae91

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 55ms
54ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=62eb5bea-0a18-4e3b-93c2-ea8af6257b7e&ccsid=99725ff3-b794-43a8-a8ef-b3421f7e7e18
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 14 KB
4 KB 111ms
110ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: eaa7e3d32d237bf9271ddb57b4068ec273bea7ce8efcf3b3eb36f3b6b5b31206

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 59ms
53ms Image
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=86e80a8c-047d-4310-ab06-0ddbae3cbf35&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qwxz.avasporelight.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=6f126d47-260d-4f00-bf12-e0f285ec8694&ccuid=62eb5bea-0a18-4e3b-93c2-ea8af6257b7e&sid=99725ff3-b794-43a8-a8ef-b3421f7e7e18&nct=1745632215000&r=https%3A%2F%2Fqwxz.avasporelight.com%2F&ns=true&lang=en-US&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&devicefp=146.70.45.122%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=6f705e6d-9a22-4150-9e94-f746ee6a2d18&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Sat, 26 Apr 2025 01:50:16 GMT
content-length: 0

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame DA3F 430 B
902 B 55ms
54ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=3&topUrl=paint.toys&bundle=w-UN-l9LR056WnlRdFl0ZjFSNkJqdm1KVEpSYzJCZkt6RERvVngxd1J0QmtORiUyQmR0QmowTDFCVnpGckdUWUIlMkJ4UXYwc0V5U0NodG1CTWZpR2JFbUVGQjdVNTBVQzMzdmpTeWJ3MTRpbDRIZHlMWlU4bnlVT1l6SlRZeXAxJTJGajFjcVBzbA&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

9a4ee96b018f83dc4e79689dbae4b444f1711b3ed445c74eb73b7fae05296a50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1205979
expires: 0
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H3 200 ad_large. Show response
fundingchoicesmessages.google.com/f/AGSKWxW0M5p5LBmFZyqvt1lvnVBSPFINLesQ8TnSKsLGp0aP_iB2ySDhUO01S6X83hwSPbFch2bZi4wK78Gb72AL-NfpF5Ypax4ZOIRPQ1GGnRHVzvUSu_rKBO5ezRYOaqcBviwKiE9BDVOJrTCnjqBX5xW4V_D5L... 54 B
109 B 76ms
71ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW0M5p5LBmFZyqvt1lvnVBSPFINLesQ8TnSKsLGp0aP_iB2ySDhUO01S6X83hwSPbFch2bZi4wK78Gb72AL-NfpF5Ypax4ZOIRPQ1GGnRHVzvUSu_rKBO5ezRYOaqcBviwKiE9BDVOJrTCnjqBX5xW4V_D5LtnTpEZ803P913XI_ZZcFj534dQt-Wy6/_/adx2.powvideo.net.il/ads//admixer-/ad_large.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.iCXLdUr9n0U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSEyvXofDNu5qDly3KLGW1OQt1zg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6f55b146c2e5263ff421b720f4163f68fa52241e1d0f3728a3d2afc1b9934b52

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-aRcGTYL5MC3kTyup5sJqgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw1ZBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GTdtfEW62EgbtK-zdoFxEI8HDe-bzjAJtBx-MFJRiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxMjEz0Dg_gCAwCkKDwv"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-aRcGTYL5MC3kTyup5sJqgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 289ms
106ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.iCXLdUr9n0U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSEyvXofDNu5qDly3KLGW1OQt1zg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f88fd9fb064f0528d3dd22d33852e8baa94724247013aa406810b88bef04f0f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 17716711681685938139
age: 1460
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 02:25:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 01:25:56 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80843
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxWRenGMdoW5SWucxsICoUBPKEbtJ9ezzU-k6vqdEvDYFi1Xvu5tADVsgIw-Y5gYvMo7FObEhN26CW9HmvTffCykSl9BcjKoI9A97b94P4NcqD-A-h01HiywTRSmb2O19rPfUs4iRw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 123ms
66ms XHR
text/html 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRenGMdoW5SWucxsICoUBPKEbtJ9ezzU-k6vqdEvDYFi1Xvu5tADVsgIw-Y5gYvMo7FObEhN26CW9HmvTffCykSl9BcjKoI9A97b94P4NcqD-A-h01HiywTRSmb2O19rPfUs4iRw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-r_gvnvqCrJvuW6iTVgKzCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAvxcNz4vuEAm8CPBx8fMiq5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTIxM9A7P4AgMAxiAlxg"
content-security-policy: script-src 'report-sample' 'nonce-r_gvnvqCrJvuW6iTVgKzCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B2D5 20 KB
7 KB 54ms
53ms Document
text/html 23.54.45.11
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.45.11 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-45-11.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=71237
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 26 Apr 2025 01:50:16 GMT
expires: Sat, 26 Apr 2025 21:37:33 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 281ms
280ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

321782ef2311c46006f156449496b847c60c552eb400896baeddd46559ed1a1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: application/json
vary: Origin

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRenGMdoW5SWucxsICoUBPKEbtJ9ezzU-k6vqdEvDYFi1Xvu5tADVsgIw-Y5gYvMo7FObEhN26CW9HmvTffCykSl9BcjKoI9A97b94P4NcqD-A-h01HiywTRSmb2O19rPfUs4iRw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KIPZMk3iKM00yyEyX2VPoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw1JBi-FB_mfUHEAvxcNz4vuEAm8CBhb2vGZVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJkYmegVl8gQEAjS4k_g"
content-security-policy: script-src 'report-sample' 'nonce-KIPZMk3iKM00yyEyX2VPoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 081C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

269 B
379 B

309ms
152ms

Document
text/html

23.220.141.176
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.220.141.176 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-141-176.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 26 Apr 2025 01:50:17 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:50:17 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
server: AkamaiGHost

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B2D5 2 KB
3 KB 466ms
81ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=24278798&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 113e5878821d60b70c242dbe40e5cef0a652cde128c057493b3c0762c56f970f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRenGMdoW5SWucxsICoUBPKEbtJ9ezzU-k6vqdEvDYFi1Xvu5tADVsgIw-Y5gYvMo7FObEhN26CW9HmvTffCykSl9BcjKoI9A97b94P4NcqD-A-h01HiywTRSmb2O19rPfUs4iRw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Sts-DKQc_psPzJ-n8W-qkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtHikmII0pBiWMy_i-lD_WXWH0AsxMNx4_uGA2wCO94_fsGk5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwNTIxM9AzM4gsMAEoVJxM"
content-security-policy: script-src 'report-sample' 'nonce-Sts-DKQc_psPzJ-n8W-qkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRenGMdoW5SWucxsICoUBPKEbtJ9ezzU-k6vqdEvDYFi1Xvu5tADVsgIw-Y5gYvMo7FObEhN26CW9HmvTffCykSl9BcjKoI9A97b94P4NcqD-A-h01HiywTRSmb2O19rPfUs4iRw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-VV17g52m-5sn4Z0d7pnslw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAvxcNz4vuEAm8CB2T0vmZRckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJkYmegVl8gQEAiWAk8g"
content-security-policy: script-src 'report-sample' 'nonce-VV17g52m-5sn4Z0d7pnslw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUF5zzldRSeR60m2I5gRBKtzOVjU0Gr_gv3NilhoTlFnsBcVImA5Y-EX9RyqbGs2-EUFclHsilu9DBNADPK93_s7ealGYzD-NO9_RrNrkFRPTA1nv6L5tpu-d6wd45wxca0OYaCuw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 122ms
119ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUF5zzldRSeR60m2I5gRBKtzOVjU0Gr_gv3NilhoTlFnsBcVImA5Y-EX9RyqbGs2-EUFclHsilu9DBNADPK93_s7ealGYzD-NO9_RrNrkFRPTA1nv6L5tpu-d6wd45wxca0OYaCuw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjMyMjE2LDcxODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJpQ1hMZFVyOW4wVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxd3h6LmF2YXNwb3JlbGlnaHQuY29tIl0sWzI1LCJbWzk1MzQwMjUyLDk1MzQwMjU0XV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

29471ff7f47869281192df1d13d66f0b58a54150d11396e27cd1b514f4d01401

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-q8qrouTIJsZZFwseEfCyow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmLw1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GRds_EW61YgbtK-zdoFxEI8HDe-bzjAJtBwds5nJiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxMjEz0Dg_gCAwCbizwC"
content-security-policy: script-src 'report-sample' 'nonce-q8qrouTIJsZZFwseEfCyow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxVf5_yhOaNywAkvw_JOXRdh6N0Rizug-Bwly3DEEjGFsROy69SjDklSLrqpwCfbOCBpOivGcLDIyE5hEedTj_jMewolZQCLtMZjUfQ5rsTvlcHaKMDXjqj50GQVlJw6VeLTTtkS-w== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 72ms
69ms XHR
text/html 172.253.115.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVf5_yhOaNywAkvw_JOXRdh6N0Rizug-Bwly3DEEjGFsROy69SjDklSLrqpwCfbOCBpOivGcLDIyE5hEedTj_jMewolZQCLtMZjUfQ5rsTvlcHaKMDXjqj50GQVlJw6VeLTTtkS-w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PVF71hJFwrzYPl-dVFIkdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw1JBi-FB_mfUHEAvxcNz4vuEAm8CHM8-WMiu5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTIxM9A7P4AgMAreslbg"
content-security-policy: script-src 'report-sample' 'nonce-PVF71hJFwrzYPl-dVFIkdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame A39C
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=

35 B
591 B

131ms
131ms

Document
image/gif

185.167.164.48
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Sat, 26 Apr 2025 01:50:17 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sat, 26 Apr 2025 01:50:17 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 1F6B
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=58D4D86C-1A37-49F0-88F8-7CE261999DE3&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=58D4D86C-1A37-49F0-88F8-7CE261999DE3&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

79ms
78ms

Document
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=58D4D86C-1A37-49F0-88F8-7CE261999DE3&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-87-86-226.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:50:17 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 7H1QYTQVC18K42R3P3W9

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:17 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=58D4D86C-1A37-49F0-88F8-7CE261999DE3&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: PZQZZJSAFBBDEJPRPYQ8

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 25E5
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=280266010643178489&gdpr=0&gdpr_consent=

42 B
296 B

67ms
66ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=280266010643178489&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 25 Apr 2025 19:41:19 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 8250efcb-ae16-485c-8ed0-0c8f4cbd447c
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:50:17 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=280266010643178489&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 146.70.45.122; 146.70.45.122; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 05B0 0
907 B 69ms
67ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=58D4D86C-1A37-49F0-88F8-7CE261999DE3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93626dacfa0d347f-MIA
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:50:17 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632217&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JUhNJ1zdwaRE9R1Q%2BylR7eIeM6pMJIjV9pWp8j%2FeNeI%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632217&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JUhNJ1zdwaRE9R1Q%2BylR7eIeM6pMJIjV9pWp8j%2FeNeI%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame B2D5
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=58D4D86C-1A37-49F0-88F8-7CE261999DE3
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=0135122f-bc04-46e2-ac22-d03cf7915d6d

42 B
317 B

80ms
78ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=0135122f-bc04-46e2-ac22-d03cf7915d6d
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=0135122f-bc04-46e2-ac22-d03cf7915d6d
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200
OK

/
bidberry.net/ Frame B2D5
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-lL3KPvZE2pRdAZAyuCME_bS._yuImBCm.g--~A&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=49c3faef-6035-48d8-870a-95c452414c25&icm&gdpr=0&gdpr_consent=&cver
https://bidberry.net/?partner=1&mapped=e17db2eb0b3c119b&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/map/c=14544/tp=BIDB/gdpr=0/gdpr_consent=?https%3A%2F%2Fbidberry.net%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D%26redirect%3D
https://bidberry.net/?partner=104&icm&cver&mapped=d59c9c3df8e940067a75b92c3dee8e42&gdpr=0&redirect=

35 B
245 B

155ms
154ms

Image
image/gif

57.129.39.243
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://bidberry.net/?partner=104&icm&cver&mapped=d59c9c3df8e940067a75b92c3dee8e42&gdpr=0&redirect=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 57.129.39.243 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3235992.ip-57-129-39.eu
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-type: image/gif
content-length: 35

Redirect headers

expires: 0
cache-control: no-cache
location: https://bidberry.net/?partner=104&icm&cver&mapped=d59c9c3df8e940067a75b92c3dee8e42&gdpr=0&redirect=
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
pragma: no-cache

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame B2D5
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=58D4D86C-1A37-49F0-88F8-7CE261999DE3&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=58D4D86C-1A37-49F0-88F8-7CE261999DE3&sInitiator=external&gdpr=0&gdpr_consent=

42 B
603 B

70ms
70ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=58D4D86C-1A37-49F0-88F8-7CE261999DE3&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 2
Pragma: no-cache
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Sat, 26 Apr 2025 01:50:17 GMT
Content-Length: 42
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=58D4D86C-1A37-49F0-88F8-7CE261999DE3&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 1
Pragma: no-cache
Connection: Keep-Alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Sat, 26 Apr 2025 01:50:17 GMT
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame B2D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NThENEQ4NkMtMUEzNy00OUYwLTg4RjgtN0NFMjYxOTk5REUz&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK5Ongg_AmeGJknsWKTZn54&google_cver=1

42 B
97 B

359ms
64ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK5Ongg_AmeGJknsWKTZn54&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK5Ongg_AmeGJknsWKTZn54&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Sat, 26 Apr 2025 01:50:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame B2D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WNTYbBo3SfCI-HziYZmd4w%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEBIcz8XoMnL2Iml19uONFEo&google_cver=1

10 KB
10 KB

60ms
59ms

Image
text/html

23.54.45.11
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEBIcz8XoMnL2Iml19uONFEo&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.54.45.11 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-45-11.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=71236
content-encoding: gzip
expires: Sat, 26 Apr 2025 21:37:33 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Sat, 26 Apr 2025 01:50:17 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEBIcz8XoMnL2Iml19uONFEo&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Sat, 26 Apr 2025 01:50:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame B2D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK5Ongg_AmeGJknsWKTZn54&google_cver=1

42 B
527 B

293ms
164ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK5Ongg_AmeGJknsWKTZn54&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK5Ongg_AmeGJknsWKTZn54&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Sat, 26 Apr 2025 01:50:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame B2D5
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:86B74E0C640B4F2EB528A0B3C9708426

42 B
247 B

145ms
145ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:86B74E0C640B4F2EB528A0B3C9708426
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:86B74E0C640B4F2EB528A0B3C9708426
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Fri, 25 Apr 2025 01:50:17 GMT
access-control-allow-origin: *
content-length: 142
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B2D5
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=

42 B
543 B

201ms
82ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:16 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=
content-length: 355
date: Sat, 26 Apr 2025 01:50:17 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame B2D5
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-oU4VrhFE2uVViW06.D3sgHRNtsURMJo-~A&gdpr=0

0
260 B

301ms
152ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-oU4VrhFE2uVViW06.D3sgHRNtsURMJo-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 25 Apr 2025 19:41:57 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-oU4VrhFE2uVViW06.D3sgHRNtsURMJo-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: text/html
server: ATS

GET
H2 200 58D4D86C-1A37-49F0-88F8-7CE261999DE3
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame B2D5 43 B
519 B 63ms
57ms Image
image/gif 52.87.86.226
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/58D4D86C-1A37-49F0-88F8-7CE261999DE3?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.87.86.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B2D5
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=cdf0bf34-055e-45ac-afce-82360ffe47b2&gdpr=0&gdpr_consent=

1 B
335 B

134ms
132ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=cdf0bf34-055e-45ac-afce-82360ffe47b2&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 25 Apr 2025 19:22:53 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: 0a3587f8-b381-48b4-9d4e-8a7eb63d743c
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=cdf0bf34-055e-45ac-afce-82360ffe47b2&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Sat, 26 Apr 2025 01:50:17 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 081C 44 KB
11 KB 109ms
108ms Script
text/html 23.220.141.176
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.220.141.176 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-141-176.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: cf93b1fadcd08acad574d6b9388a3a26cd9ce1e0ffe32b71a983f58b34ddb6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

Response headers

cache-control: max-age=56765
content-encoding: gzip
expires: Sat, 26 Apr 2025 17:36:22 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Sat, 26 Apr 2025 01:50:17 GMT
last-modified: Fri, 25 Apr 2025 17:36:20 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 01FB
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%2...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_conse...

2 KB
1 KB

73ms
73ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5817d4298154dbcd7309475e162bb8bcb4d7c4dc3efe3670f81a95a25509bf00

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93626db109f1f471-MIA
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:50:17 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S0knidAEIQlShmtV4IC2OZxk6cKPV0wyjqx78%2FwwpTIdyNebikve7Tj2KtYVyQTguZGMf7xQxh1ecXCKC7f%2B9tvy%2FrMRx%2FRg6A%2FilCiz8xO5VeBrsCjQBRLxdWt%2FV0xxBdfI%2BUkbG%2BDcAw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93626db07fd5f471-MIA
content-length: 0
date: Sat, 26 Apr 2025 01:50:17 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKAKUE9aGxypDj%2FAmr6AArFcZXo1sn9bOXxv%2FQrQS24HnDtD7Fg%2BmkWLpV3RdtEKMq6BYAKWt495u4v4h0V51I8U7sV4ca4t14UNySUrbTQcA%2Fn5VQ4TT%2BMLSR2xeNZukWlyTE%2BQWVzbcw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
3 KB 415ms
412ms Fetch
text/plain 142.250.31.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=8702872191785283&correlator=1255434968719377&eid=83321073%2C95340252%2C95340254&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745632217867&lmt=1745632217&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqwxz.avasporelight.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1Kk1vVTVUSEdaTm5LWDJyaExRX0dHWWNYTGFnVWdhQWl6eTdYcS1FMjctZDhTajB5a1EzWk5pSXpkOExGZDBQNTFYARI0CgpwdWJjaWQub3JnEiRiNWZmM2MzNC1lYzMxLTQxMDMtODRlYS1kZTFjZDM4ZWE2MTFYARInChJydWJpY29ucHJvamVjdC5jb20SD004WVhJS0hLLUstMU1ONlgBEjYKDHB1Ym1hdGljLmNvbRIkMTVCRUUyNEItRDExMy00QjA1LUIyRkEtQTMzNTZFMDdERDQyWAESNwoNYmlkc3dpdGNoLm5ldBIkMjAyOWI2YmMtNmZmOS00NGQwLTkzNzUtMGYwOTc4NmU3ZDIyWAESPwocbGl2ZWludGVudC5pbmRleGV4Y2hhbmdlLmNvbRIdWi5SaDJNQW9Ja3dBS1l2eUF2a3lhUUFBJjIwMjdYARLWAQoOZXNwLmNyaXRlby5jb20SugF3LVVOLWw5TFIwNTZXbmxSZEZsMFpqRlNOa0pxZG0xS1ZFcFNZekpDWmt0NlJFUnZWbmd4ZDFKMFFtdE9SaVV5UW1SMFFtb3dUREZDVm5wR2NrZFVXVUlsTWtKNFVYWXdjMFY1VTBOb2RHMUNUV1pwUjJKRmJVVkdRamRWTlRCVlF6TXpkbXBUZVdKM01UUnBiRFJJWkhsTVdsVTRibmxWVDFsNlNsUlplWEF4SlRKR2FqRmpjVkJ6YkEY0IWn_uYySAASGAoJeWFob28uY29tGOOFp_7mMkgAUgIIbxIUCgVvcGVueBjyhKf-5jJIAFICCG8SGwoMMzNhY3Jvc3MuY29tGLyDp_7mMkgAUgIIZBLuAQoIcnRiaG91c2US2AFKRW8rU1JoZzJtRyt6TGZtNDcvNWpWSU5DVWVjSy9qaWVMOCtXL0VrVVhteWlCajFXdlpWb214clp0VHlNcnVVUys3NHFxOFYzc2IzUzZ2M1RIQ3dGbmFBN25JRUhtRmVicXNxeGVBVUdUMTBwWkpsZ2NWaW9BaThlWDF1emEzM09QWkpWbHNoWS8xcDdBOGpKblFiaitjaytMc1N1WTdpN25oYjFBNUxlUGNSK2ltQnpIYWUxcWR0Z25XbXdsT0VxcCtBSGYyZWFXQmZBdjVLZmpLUXl3PT0YiYin_uYySAASMwoJb3BlbngubmV0EiQyMWQ1MmQ3Mi01NGEzLTAzZDYtMDJiYS1lZmFkYmI5NGU2YjdYARKHAQoObGl2ZWludGVudC5jb20SczE0LXlMdUVZSVJTL0prWVJack1oc1J4RkxwNlF3Z1plOVlpamo2aDZBd25WQlMzc3pZV3lIeXU4aGkzbVNVTnBzTGJMWUdrbVBiazBibVArbVFNVDkrTjR4aGNndjFVVmhxVGREUW9IZmNId3FEa0FBPT1YARI1ChlsaXZlaW50ZW50LnRyaXBsZWxpZnQuY29tEhYzMDk0MDY4OTEzMDc2MTMwOTA0MjA1WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745632214275&idt=719&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3De10fee4170564318b90c4f21885e76f332215241%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_format_ozone%3Dbanner%26hb_size_ozone%3D160x600%26hb_pb_ozone%3D0.21%26hb_adid_ozone%3D1230ce1c45ffce52-0-oz-1%26hb_bidder_ozone%3Dozone%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.21%26hb_adid%3D1230ce1c45ffce52-0-oz-1%26hb_bidder%3Dozone%26oz_size%3D160x600%26oz_adId%3D1230ce1c45ffce52-0-oz-1%26oz_pb_r%3D0.21%26oz_pb%3D0.2117632%26oz_pb_v%3D2.9.5%26oz_imp_id%3D1230ce1c45ffce52%26oz_uuid%3Dno-id%26oz_cache_id%3Dno-id%26oz_bid%3Dtrue%26oz_winner%3Dozopenx%26oz_auc_id%3Dab3b9399-d72a-4134-9f97-15cef79fe7a7%26oz_ozopenx_dealid%3DOX-XPT-ikWLNt%26oz_ozopenx_size%3D160x600%26oz_ozopenx_pb_r%3D0.21%26oz_ozopenx_adId%3D1230ce1c45ffce52-0-oz-1%26oz_ozopenx_adv%3Dlowes.com%2Cinternetalerts.org%26oz_ozopenx_crid%3D2621_750586341%26oz_ozopenx%3Dozopenx%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D469762048%252C218890240%26cc-iab-class-id%3D482%252C283%26cc-iab-name%3DShopping.Children%27s%2520Games%2520and%2520Toys%252CHome%2520%2526%2520Garden.Interior%2520Decorating%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqwxz.avasporelight.com%252F%26tyche_code%3DV.20250423.1%26pageos_code%3DV.20250423.1%26config_id%3D1024872_74068_primary_config%26hour%3D15%26day%3DFriday%26referrer_domain%3Dqwxz.avasporelight.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250423.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%252C66%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=52850&tan=23fe3be9-e637-41b4-83bd-4e24ca9910b4&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9bca79d8da0d6faec4b3ddf18257ec56dd33e87fbb24071a3c8b02985798c316

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 6914815129
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138503288334
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 3017
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
5c6efa1ff08ac4fed1f0532a6a65d09e.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 037E 7 KB
3 KB 250ms
74ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://5c6efa1ff08ac4fed1f0532a6a65d09e.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f132.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:50:18 GMT
expires: Sat, 26 Apr 2025 01:50:18 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET

cksync
cs.media.net/ Frame 01FB
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aAw72cAoJI0AHdKJAZBS1wAA%261617&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=53018a43-eca9-4753-b85b-fa36c02047e4&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=53018a43-eca9-4753-b85b-fa36c02047e4&vxii_pid=12&vxii_pid1=7006&vxii_rcid=267d730f-517d-4c20-9e43-585232ad1f75&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=267d730f-517d-4c20-9e43-585232ad1f75
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=49c3faef-6035-48d8-870a-95c452414c25
https://cs.media.net/cksync?cs=1&ovsid=267d730f-517d-4c20-9e43-585232ad1f75&redirect=https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5048%26vxii_pdid%3D%3Cvsid%3E%26vxii_ts%3D2&type=thr&us_privacy=&vx...

0
0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 01FB 43 B
855 B 62ms
62ms Image
image/gif 98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aAw72cAoJI0AHdKJAZBS1wAABlEAAAAB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 6GM7ZE7WFYD6FK4QSERZ
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 26 Apr 2025 01:50:17 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 01FB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aAw72cAoJI0AHdKJAZBS1wAABlEAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEAw93KVc7WQFIm_kCAARHrs&google_cver=1

43 B
766 B

69ms
68ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEAw93KVc7WQFIm_kCAARHrs&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V6yzAW0Er3Ux5WqDwzMkvCPmt7YQ6gGYlB%2FtBfl5%2B6Mg0PzNpIy0t1A%2FkCtziyvRVps3nMSYkBS6%2BLfQQE9XVfuOXNKgUwdpUMjTyPOPkkn15LYUBVcko2KQiGbe0iUY2%2F2f6iR98VSQYw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db26eaaf471-MIA
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEAw93KVc7WQFIm_kCAARHrs&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 364
date: Sat, 26 Apr 2025 01:50:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 01FB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aAw72cAoJI0AHdKJAZBS1wAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEN4p1n6FkEi3j0i_VBklpAU&google_cver=1

43 B
765 B

70ms
70ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEN4p1n6FkEi3j0i_VBklpAU&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9rNHKu%2BwP2FizWLDHKOvc5GZb6e1U87mFI%2FeITyzwy8UTPh6IknYHL5nj5SqeDt6LJZQqAJvn85vRgd8JI0QdUevL2V%2FChzzGLuQ0%2BrzIjpLbFWtyot0c944qvNmYMA8USyMeQmAnt24VQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db2e82cf471-MIA
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEN4p1n6FkEi3j0i_VBklpAU&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum.casalemedia.com/ Frame 01FB
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=71b2c4be7c7b07ae&is_secure=true&networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AQADrh6cV1G3EAJYB97iAQEBAQEBAQCXbsjNlwEBAQEBAQEB&expiration=1745718618&is_secure=true

43 B
760 B

73ms
73ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AQADrh6cV1G3EAJYB97iAQEBAQEBAQCXbsjNlwEBAQEBAQEB&expiration=1745718618&is_secure=true
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fFHNZGJ67qMFlM55jl7OWZcxhGim%2FkiNE96rNKhjOhhli1pXdBjLO%2FdZSWZPigJKBt%2FR%2BKWqXAIQ0KP60TSj4IVyb03dXQ0Gw%2BrLreD%2BBCha%2BhOodSyMcTavuLIfW85twNNfb3K9"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db46ce4f471-MIA
content-length: 43
server: cloudflare

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AQADrh6cV1G3EAJYB97iAQEBAQEBAQCXbsjNlwEBAQEBAQEB&expiration=1745718618&is_secure=true
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
pragma: no-cache
server: nginx

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 01FB
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=86B74E0C640B4F2EB528A0B3C9708426

43 B
770 B

74ms
74ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=86B74E0C640B4F2EB528A0B3C9708426
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DU87AKMnePruGNNHlFuCv400KJGJR0vh%2BDBLBdWZ%2F%2BN48Tm%2FbhNWnJ1TdOQJ8BZDu6SB8Cs7nwZzeoFRHb85PkSUUTyubpMOEezggH5AgfnjowhgxNwnF%2BaDZaktS1nW%2B3%2Bmpi8wLBB8Sw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db25e86f471-MIA
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=86B74E0C640B4F2EB528A0B3C9708426
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Fri, 25 Apr 2025 01:50:17 GMT
access-control-allow-origin: *
content-length: 142
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3

200

crum
dsum.casalemedia.com/ Frame 01FB
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=280266010643178489

43 B
754 B

87ms
86ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=280266010643178489
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bkeokYqy%2BI5%2BjuDQaypeil0cEi4EoTZztiDtP2bKmKXE8DPzFjPl35ymTdoPgmYOH4r27AAKFytKXCfVzcH8QzpIS1oImTHoAPJ%2BFoS8tKRpT32ZeFlaVyPKoZgq2UflAz%2BPkvU7"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db28f05f471-MIA
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=280266010643178489
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.45.122; 146.70.45.122; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 55592833-40c3-414e-b2e5-7ca9ea929933
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:17 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 01FB
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.ca...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662156906186930

43 B
769 B

77ms
76ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662156906186930
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BqOw6D2RQi1zd%2BO3AmeV%2Bo%2B06MWKpxrJwhmP6OBhNJpnAVSamCGAIIYm6FquZjKqviyGBXw1LrAa0ojO3aTcbmaB0jcypXFHYfVr9EEKUDGXMpAyj7Haf2v6I%2BnV%2F%2FEADoy4vfAKvSquiA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db39a55f471-MIA
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, private
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662156906186930
cf-cache-status: DYNAMIC
pragma: no-cache
x-function: 209
cf-ray: 93626db2ef666db5-MIA
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-reuse-index: 1833
p3p: CP="NOI DEVo TAIa OUR BUS"
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/html
server: cloudflare
priority: u=3,i

GET
H3 200 setuid
prebid.intergient.com/ Frame 01FB 0
1008 B 91ms
90ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aAw72cAoJI0AHdKJAZBS1wAA%261617
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632217&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JUhNJ1zdwaRE9R1Q%2BylR7eIeM6pMJIjV9pWp8j%2FeNeI%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632217&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JUhNJ1zdwaRE9R1Q%2BylR7eIeM6pMJIjV9pWp8j%2FeNeI%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93626db20aa2347f-MIA
server: cloudflare

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 081C 7 B
1 KB 274ms
84ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
content-length: 7
content-type: application/json; charset=UTF-8

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9E70 0
0 66ms
65ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJlHan9gMxy2u3uv_ASRCjI3ZSYdB3yucjAydin2Dc_2ElSG2WMzIyXGF45sepGLWqXeJxVnA-d-xv2jIP9sbpj-zmAby0ThiJF9sL8-7vf9aw68vUtdbut0K4v3vbkuk5-twpO86-AgrHKDPU1DNSFdKbQ5RBLe1ZNsEjON4zvdl6Qdt6QJB73R7mMqNAQ1XHz0qvpNa86y-G-F1XtlGb77eri4XRHF25zlWN2i5w1GS-jycCRsA-NEcQSnCpgaQWrEvvscbH9O4qDzrhbfwc0wfYKtieczVx03YLnZ_Tsztrplw-B605MVx4dpAfYLRf_nbGiRL7oM0p0NPiD8JPIwzW-JEz_dSv_47NHnfFqa4681_Vkjt-40R63Gv4gaFzh_u8tTfd8GrjHqRf08sfVFub7zVh1J-KGICV4wN5EsLigF3s1b0eHAUa2q50VPLFaXNho5oDWXKE0cQhwl89fXM93k_nSW5tr_UuS0fImepBO0OUUCE5BN51CP-N01Pa8xQlq1swQC0BOCQCGilw5Qi6hYlfivm_ZR2Cebnvp1-BncjaF6yavYfgUganoRAWkL7jM0vuvmTg_BgR252upFJkrWc&sai=AMfl-YScq05SukJcNP82_Zu2aREHZJ5iQEwV270x6WsKJvdRG7KX0xQgUqUONcZkKjTZhi0IlXkxtAa3RIz1iymEO-Hyv2jKKfyWs627OWv05vggIdy5Tkc6Va3ZJdAH&sig=Cg0ArKJSzEEsMATlkrAOEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 jsonp Show response
iad-usadmm.dotomi.com/fetch/banner/ Frame 9E70 63 KB
18 KB 523ms
89ms Script
text/javascript 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/gttycnnfnaftmyoqjbcsafrmoclecjRdGloVWlOWE1PSlU5S0l5VzhzbjctMjY5MC0yNjcxNTk3MS0xMDA3MDI3OC0zODM2LW5VaVRXd2R0eExBQjZCdGl3UUZy/774ska3lc1jirm9ezu647utwepgmwj9qn/uqyvrd/vi0vpwevtgbcl
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a11d267fa7fe374f4d5489b6cfa8d24b54cbcf1972582f2bf842351def6328e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
content-encoding: gzip
pragma: no-cache
expires: 0
content-length: 17973
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/javascript
server: nginx

GET
H2 200 pd Show response
eu-u.openx.net/w/1.0/ Frame BE18 813 B
1 KB 49ms
43ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=1181da47-c354-4bc6-ad66-d62e13666e05
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 53d0d2e9b9bd1e15804e990f808f3384810e275813ac77d7776b7fba64107cf1

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 813
content-type: text/html
date: Sat, 26 Apr 2025 01:50:17 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 146.70.45.122

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9E70 220 KB
68 KB 52ms
52ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a798986e0dce849145906cae97bf77a273b5ffb8880fc0f7da14eff4a9b85aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4151480097505160345
age: 2903
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 02:01:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 01:01:55 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69290
x-xss-protection: 0
server: cafe

GET
H2 200 prebid
ox-rtb-us-east1.openx.net/win/ Frame 9E70 43 B
291 B 226ms
72ms Image
image/gif 34.95.78.255
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://ox-rtb-us-east1.openx.net/win/prebid?p=FIRST&t=2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA&ph=1181da47-c354-4bc6-ad66-d62e13666e05
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.78.255 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 255.78.95.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif
vary: Origin

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
229 B 516ms
88ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&etype=9999&edtl=-1,1,4eec,9252682,561707207,540731760,15900,1,2,null,750586341,40048300,21,160,600,0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
server: nginx

GET
H2 200 wp.gif
elb.the-ozone-project.com/ Frame 9E70 0
164 B 116ms
115ms Image
image/gif 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/wp.gif?currency=USD&seat_id=&request_id=ab3b9399-d72a-4134-9f97-15cef79fe7a7&adunit=pw-160x600_atf&size=160x600&adomain=%5Blowes.com%2C+internetalerts.org%5D&imp_id=1230ce1c45ffce52&auction_id=&bid_id=24b17119-efc8-47db-a3c3-b0b61255e868&crid=2621_750586341&price=0.2117632&seat_name=ozopenx&publisher_id=OZONEPLA0001&dealid=OX-XPT-ikWLNt
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93626db4cf4502dc-MIA
expires: Wed, 11 Nov 1998 11:11:11 GMT
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
last-modified: Sat, 26 Apr 2025 01:50:18 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 127E 20 KB
7 KB 56ms
56ms Document
text/html 23.54.45.11
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.45.11 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-45-11.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=71235
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 26 Apr 2025 01:50:18 GMT
expires: Sat, 26 Apr 2025 21:37:33 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 624B 0
0 523ms
110ms Document
text/plain 198.199.91.118
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.91.118 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:50:18 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame F376 3 KB
2 KB 143ms
38ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 877
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 93626db588ca33e0-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 26 Apr 2025 01:50:18 GMT
expires: Sat, 26 Apr 2025 05:50:18 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 7AD6 16 KB
6 KB 64ms
56ms Document
text/html 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 01:50:17 GMT
server: Kestrel
server-processing-duration-in-ticks: 706506
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 31EB 269 B
379 B 62ms
54ms Document
text/html 23.220.141.176
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.220.141.176 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-141-176.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 26 Apr 2025 01:50:18 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame EB9D 813 B
1 KB 52ms
44ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 53d0d2e9b9bd1e15804e990f808f3384810e275813ac77d7776b7fba64107cf1

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 813
content-type: text/html
date: Sat, 26 Apr 2025 01:50:17 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 146.70.45.122

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame D440 11 KB
4 KB 155ms
85ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 918d6546c86fb321c830b83d1a3368efcb5c7636bf71b7cf0094e23c45fae522

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93626db55b29a658-MIA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:50:18 GMT
expires: 0
last-modified: Tue, 22 Apr 2025 13:00:55 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 693B 52 KB
17 KB 114ms
35ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 46912
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sat, 26 Apr 2025 01:50:18 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1157439, 150993
X-Served-By: cache-lga21993-LGA, cache-mia-kmia1760072-MIA
X-Timer: S1745632218.469687,VS0,VE0

GET
H2

200

sync Show response
eb2.3lift.com/ Frame C973
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
2 KB

70ms
70ms

Document
text/html

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: a275282c0879a59cb2b1afdd4fa27564155c7bbfb8d0099e2fdd48fbcb51fe33

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:50:18 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
location: /sync?&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 63ms
56ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=o98s119LR056WnlRdFl0ZjFSNkJqdm1KVEpSc25lQWlEQVE1ZldKRHglMkIyZWpMNTZNZjA2NjRVJTJCWjBvWFlaWkZSRnN4U3FDMWV4cmdzODhqbVdFd3BqMyUyQllEbjBtaGlQcGpETnpuVmNRZm5pY3lZcW1NYk1rSFMzNFJlQSUyQmM1OGJKMVBQQWJ0RGNPSGwlMkJkYXBTaTlvcjkyczJnJTNEJTNE&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 26 Apr 2025 01:50:17 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 258847
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 322ms
320ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-80-106-25.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
663 B 67ms
59ms Fetch
application/javascript 52.201.17.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.17.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-17-141.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: b0c17474db432b31b5087e12e96d5c6c744aaf765f20fe0aa225b3ce90c14bca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 67ms
59ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&tp=44aWotQkKrtfYdSIImqpOmgnJHnRsS2oqDqVcd9v0b0%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7202e8ffd0037bf677c0a549c4f1c06d867b25581b22d18d77be35e14c6804a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 483 B
0 5ms
5ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jsqwkg4fv758ht6k8dv2792d&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-72-103.compute-1.amazonaws.com
Software: /
Resource Hash: ab5ca1f3eb952518a00dadfd3a427081101f11cf608e07bb354331e6baabb279

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 6084d1d15d8e8acb
request-time: 4
access-control-allow-credentials: true
expires: Sun, 27 Apr 2025 01:50:15 GMT
access-control-allow-origin: https://paint.toys
content-length: 483
date: Sat, 26 Apr 2025 01:50:15 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 420 B
1 KB 62ms
53ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0e6c4612cf4febf57cd181ae06dde4f1a86c7cfc549df43a7500dfe5f334919a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1094605
expires: 0
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

ibs:dpid=903&dpuuid=49c3faef-6035-48d8-870a-95c452414c25
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=49c3faef-6035-48d8-870a-95c452414c25

42 B
716 B

60ms
59ms

Image
image/gif

54.80.106.25
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=49c3faef-6035-48d8-870a-95c452414c25

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.80.106.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v076-033141ab7.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: /H0135TfRKg=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=49c3faef-6035-48d8-870a-95c452414c25
content-length: 189
date: Sat, 26 Apr 2025 01:50:19 GMT
server: Kestrel

GET sync
ssbsync.smartadserver.com/api/ 0
0

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid
https://cs.iqzone.com/a29fd8b19731bab59f20e229072c6f1e.gif?redir=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D494%26user_id%3D%5BUID%5D%26expires%3D14%26ssp%3Dthemediagrid%26bsw_param%3D${bsw_pa...
https://x.bidswitch.net/sync?dsp_id=494&user_id=8ae8e6b9-2354-452a-bd8a-5fdbaf49e930&expires=14&ssp=themediagrid&bsw_param=${bsw_param}

43 B
103 B

73ms
72ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=494&user_id=8ae8e6b9-2354-452a-bd8a-5fdbaf49e930&expires=14&ssp=themediagrid&bsw_param=${bsw_param}
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://x.bidswitch.net/sync?dsp_id=494&user_id=8ae8e6b9-2354-452a-bd8a-5fdbaf49e930&expires=14&ssp=themediagrid&bsw_param=${bsw_param}
Pragma: no-cache
Connection: keep-alive
Expires: 0
Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:19 GMT
Server: nginx

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=sharethrough&user_id=d9d48472-7675-4e15-bf77-89a2df7ddc08&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=&expires=365
https://x.bidswitch.net/ul_cb/sync?ssp=sharethrough&user_id=d9d48472-7675-4e15-bf77-89a2df7ddc08&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=&expires=365
https://p.rfihub.com/cm?in=1&pub=20513&ssp=sharethrough&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=979321856600347678&expires=30&ssp=sharethrough
https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=ab08096d-bc28-4942-942e-10897356bdf6&seat_user_id=&seat_key=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

68 B
323 B

55ms
55ms

Image
image/png

3.81.174.250
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=ab08096d-bc28-4942-942e-10897356bdf6&seat_user_id=&seat_key=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

3.81.174.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=ab08096d-bc28-4942-942e-10897356bdf6&seat_user_id=&seat_key=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:19 GMT

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=7ead435e-a2cd-4cbf-8876-adb66822613f&ph=c6b01e12-aa62-4ae6-9e10-71346e597c31&r=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DF2...
https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=9a909874-c307-4d6f-b6f0-7685c4c19edd

68 B
323 B

267ms
76ms

Image
image/png

3.81.174.250
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=9a909874-c307-4d6f-b6f0-7685c4c19edd

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

3.81.174.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=9a909874-c307-4d6f-b6f0-7685c4c19edd
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=

68 B
324 B

341ms
75ms

Image
image/png

3.81.174.250
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

3.81.174.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=
content-length: 323
date: Sat, 26 Apr 2025 01:50:18 GMT
server: Kestrel

GET
H2

200

redir
rtb-csync.smartadserver.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFGNWprN1FHSGdBQUJ3V0dGcnN1Zw&gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Csas%2Cshr&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Csas%2Cshr&bee_sync_current_partner=adx&bee_sync_initiator=shr&bee_sync_hop_count=1
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAF5jk7QGHgAABwWGFrsug&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csas%2Cshr&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
https://bh.contextweb.com/bh/rtset?ev=AAF5jk7QGHgAABwWGFrsug&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cshr%26bee_sync_current_partner%3Dpp%...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cshr&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AAF5jk7QGHgAABwWGFrsug&pid=558502&do=add&gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAF5jk7QGHgAABwWGFrsug&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dshr%26bee_sync_...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=shr&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=2104995757754691308&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=vyXkw8rSq3j4JmKvTgxR3x1c&source_user_id=AAF5jk7QGHgAABwWGFrsug&gdpr=0
https://match.prod.bidr.io/cookie-sync/sas?gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAF5jk7QGHgAABwWGFrsug&partnerid=127&gdpr=0

43 B
334 B

60ms
59ms

Image
image/gif

216.22.16.8
LEASEWEB-USA-WDC

General

Check archive.org

Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AAF5jk7QGHgAABwWGFrsug&partnerid=127&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 216.22.16.8 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sat, 26 Apr 2025 01:50:19 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://rtb-csync.smartadserver.com/redir?partneruserid=AAF5jk7QGHgAABwWGFrsug&partnerid=127&gdpr=0
Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:19 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

setuid
prebid.intergient.com/ Frame 081C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=&khaos=M9XKCLXK-K-6177
https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177

0
1 KB

68ms
67ms

Image
text/html

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632218&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=8KRna0g71HMeyFcatcR1fuziEryBKCH7x%2Fl9ViX95Mk%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632218&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=8KRna0g71HMeyFcatcR1fuziEryBKCH7x%2Fl9ViX95Mk%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93626db81f75347f-MIA
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
content-length: 0
Content-Type: text/html

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BE18
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=280266010643178489

43 B
61 B

43ms
43ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=280266010643178489
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=1181da47-c354-4bc6-ad66-d62e13666e05
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eu-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=280266010643178489
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.45.122; 146.70.45.122; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: bdc10700-4a94-4536-a132-fea5583cb521
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame BE18
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=0135122f-bc04-46e2-ac22-d03cf7915d6d
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOIoEhkS_2KMOh_Yn9G4wPM&google_cver=1

42 B
60 B

78ms
78ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOIoEhkS_2KMOh_Yn9G4wPM&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=1181da47-c354-4bc6-ad66-d62e13666e05
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eu-u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOIoEhkS_2KMOh_Yn9G4wPM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 289
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame BE18
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9

95 B
427 B

77ms
77ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=1181da47-c354-4bc6-ad66-d62e13666e05

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eu-u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BE18
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=1b9ef53e-cc11-4332-804d-894a7369e646-680c3bda-5553&gdpr=0&gdpr_consent=

43 B
61 B

45ms
45ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=1b9ef53e-cc11-4332-804d-894a7369e646-680c3bda-5553&gdpr=0&gdpr_consent=
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=1181da47-c354-4bc6-ad66-d62e13666e05
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eu-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=1b9ef53e-cc11-4332-804d-894a7369e646-680c3bda-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BE18
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=cdf0bf34-055e-45ac-afce-82360ffe47b2

43 B
61 B

45ms
45ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=cdf0bf34-055e-45ac-afce-82360ffe47b2
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=1181da47-c354-4bc6-ad66-d62e13666e05
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eu-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: 0cb4681b-d86f-443a-885a-4407f6c80d9b
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=cdf0bf34-055e-45ac-afce-82360ffe47b2
Content-Length: 112
Date: Sat, 26 Apr 2025 01:50:18 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

dds
rtb.openx.net/sync/ Frame BE18
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=i6XnddjFyawVLxx4HRMGDw==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

43ms
43ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=1181da47-c354-4bc6-ad66-d62e13666e05
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eu-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E70 0
0 63ms
62ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E70 0
0 60ms
60ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 9E70 211 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ca6bee4d9a11010abcdd28d7583b32df0af39f7520cce3ff30ee1d205669fdb2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame EB9D
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=280266010643178489

43 B
61 B

44ms
44ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=280266010643178489
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:17 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=280266010643178489
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.45.122; 146.70.45.122; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 4bc07ead-654f-4e0f-a585-1e307c7adcb5
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame EB9D
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=0135122f-bc04-46e2-ac22-d03cf7915d6d
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOIoEhkS_2KMOh_Yn9G4wPM&google_cver=1

42 B
60 B

82ms
76ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOIoEhkS_2KMOh_Yn9G4wPM&google_cver=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOIoEhkS_2KMOh_Yn9G4wPM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 289
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

check
pixel.tapad.com/idsync/ex/receive/ Frame EB9D
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9

95 B
124 B

76ms
47ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=528d1eb5-2a44-4d05-b9ba-c819fd86fdb9
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame EB9D
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=c9c8840d-a60c-4c62-9e40-7fa7bb4026c7-680c3bda-5553&gdpr=0&gdpr_consent=

43 B
61 B

46ms
46ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=c9c8840d-a60c-4c62-9e40-7fa7bb4026c7-680c3bda-5553&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=c9c8840d-a60c-4c62-9e40-7fa7bb4026c7-680c3bda-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame EB9D
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=cdf0bf34-055e-45ac-afce-82360ffe47b2

43 B
61 B

44ms
43ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=cdf0bf34-055e-45ac-afce-82360ffe47b2
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: 73fcece3-457f-4550-a713-2989348dc642
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=cdf0bf34-055e-45ac-afce-82360ffe47b2
Content-Length: 112
Date: Sat, 26 Apr 2025 01:50:18 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

dds
rtb.openx.net/sync/ Frame EB9D
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=i6XnddjFyawVLxx4HRMGDw==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

48ms
47ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 31EB 44 KB
0 109ms
108ms Script
text/html 23.220.141.176
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.220.141.176 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-141-176.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: cf93b1fadcd08acad574d6b9388a3a26cd9ce1e0ffe32b71a983f58b34ddb6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=56765
content-encoding: gzip
expires: Sat, 26 Apr 2025 17:36:22 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Sat, 26 Apr 2025 01:50:17 GMT
last-modified: Fri, 25 Apr 2025 17:36:20 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E70 0
0 61ms
60ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-50-19-215-200.compute-1.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 3314 0
100 B 270ms
122ms Document
text/plain 107.21.65.208
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.21.65.208 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-21-65-208.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H/1.1

200
OK

60909
i6.liadm.com/s/ Frame 081C
Redirect Chain

https://token.rubiconproject.com/token?pid=49096
https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=M9XKCLXK-K-6177
https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=M9XKCLXK-K-6177

43 B
302 B

254ms
53ms

Image
image/gif

50.19.215.200
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=M9XKCLXK-K-6177

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

50.19.215.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 10895a2e57340813
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Sat, 26 Apr 2025 01:50:18 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=M9XKCLXK-K-6177
Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:18 GMT
trace-id: 5a3d72504221deaa
Request-Time: 1
Connection: keep-alive

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 081C 43 B
855 B 78ms
71ms Image
image/gif 98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: KDK24E3NVYXBBZ33ZCRB
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 26 Apr 2025 01:50:18 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 081C
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTExNDEwMTA3YjVjNDg3OWRjNzIxYWIwZjNiMDI5MjY4YmJmNDc0NA

170 B
188 B

65ms
65ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTExNDEwMTA3YjVjNDg3OWRjNzIxYWIwZjNiMDI5MjY4YmJmNDc0NA

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTExNDEwMTA3YjVjNDg3OWRjNzIxYWIwZjNiMDI5MjY4YmJmNDc0NA
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19ea072139d67f7022c6e463249c998e
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 081C
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/1gh0Ys_pMIWNDBDKwXnmzg?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-422TBENE2oJ4d4T0Q7OiBLmWW_6EluE9TRmGGA--~A

42 B
1 KB

96ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-422TBENE2oJ4d4T0Q7OiBLmWW_6EluE9TRmGGA--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-422TBENE2oJ4d4T0Q7OiBLmWW_6EluE9TRmGGA--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 081C
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9XKCLXK-K-6177

0
144 B

324ms
192ms

Image
text/plain

150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9XKCLXK-K-6177
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 1EF34EAB743B4499B7160EB61C719EE5 Ref B: MIA301000108053 Ref C: 2025-04-26T01:50:19Z
x-li-fabric: prod-lor1
x-li-uuid: AAYzpKxTQJQ0U/Dv3rlPOA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=M9XKCLXK-K-6177
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 081C
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

231ms
57ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=49c3faef-6035-48d8-870a-95c452414c25&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Sat, 26 Apr 2025 01:50:18 GMT
server: Kestrel

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 081C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=M9XKCLXK-K-6177&ex=d-rubiconproject.com&status=ok

43 B
479 B

66ms
66ms

Image
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=M9XKCLXK-K-6177&ex=d-rubiconproject.com&status=ok

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: TG02WHRQHQE1S46S1PZQ
Content-Length: 43
Date: Sat, 26 Apr 2025 01:50:18 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=M9XKCLXK-K-6177&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 081C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPsiXhNIITfVhvh3Tevbekk&google_cver=1

42 B
1 KB

230ms
56ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPsiXhNIITfVhvh3Tevbekk&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 8bab65602db075726861004da5629947
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPsiXhNIITfVhvh3Tevbekk&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 081C 43 B
855 B 660ms
325ms Image
image/gif 52.94.223.167
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: BDFV8SAPTZ1GYNHTSQW2
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 26 Apr 2025 01:50:19 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 081C
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTlYS0NMWEstSy02MTc3
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDu007_uI89CfIlraKZfQh0&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TTlYS0NMWEstSy02MTc3&google_push=

170 B
188 B

65ms
64ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TTlYS0NMWEstSy02MTc3&google_push=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-23-22-42-139.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:50:19 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TTlYS0NMWEstSy02MTc3&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
content-length: 0
Content-Type: text/html

GET
H/1.1 200
OK rp
match.prod.bidr.io/cookie-sync/ Frame 081C 43 B
433 B 258ms
59ms Image
image/gif 23.22.42.139
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.22.42.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: no-cache, must-revalidate
pragma: no-cache
Connection: keep-alive
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length: 43
Date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
Server: gunicorn

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame 081C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177

43 B
1 KB

86ms
81ms

Image
image/gif

68.67.160.24
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

68.67.160.24 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.45.122; 146.70.45.122; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: cbcc6614-9a87-4341-9cad-94e45bdf60f4
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:19 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e71ccbe96f42d70fa40603ada4c96b28
content-length: 0
Content-Type: text/html

GET
H3

200

pixel
capi.connatix.com/us/ Frame 081C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=M9XKCLXK-K-6177&pId=11&gdpr=&gdpr_consent=&us_privacy=

0
329 B

81ms
39ms

Image
text/plain

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=M9XKCLXK-K-6177&pId=11&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 93626db8cafc194e-MIA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=M9XKCLXK-K-6177&pId=11&gdpr=&gdpr_consent=&us_privacy=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c1df09169f58a071f2a391dff1b3307b
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
pbs.yahoo.com/ Frame 081C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-yahoo-exchange
https://pbs.yahoo.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177

0
456 B

273ms
124ms

Image
text/html

69.147.92.11
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://pbs.yahoo.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

69.147.92.11 Ashburn, United States, ASN14777 (YAHOO, US),

Reverse DNS

e1.ycpi.vip.dca.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
x-envoy-upstream-service-time: 1
age: 0
x-envoy-decorator-operation: pbs--production-usea5.mediaplatform-gcp-prod-monetization.svc.cluster.local:4080/*
referrer-policy: no-referrer-when-downgrade
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: text/html
vary: Origin,Accept-Encoding
server: ATS

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://pbs.yahoo.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2fcb300b847bad3e7dd1184ec8a1c2f5
content-length: 0
Content-Type: text/html

GET
H2

200

merge
ce.lijit.com/ Frame 081C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn
https://ce.lijit.com/merge?pid=80&3pid=M9XKCLXK-K-6177
https://ce.lijit.com/merge?pid=80&3pid=M9XKCLXK-K-6177&dnr=1

43 B
500 B

125ms
125ms

Image
image/gif

3.217.254.52
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=M9XKCLXK-K-6177&dnr=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.217.254.52 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-217-254-52.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=80&3pid=M9XKCLXK-K-6177&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:19 GMT
vary: Accept-Encoding

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 081C
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=M9XKCLXK-K-6177

95 B
124 B

49ms
48ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=M9XKCLXK-K-6177

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=M9XKCLXK-K-6177
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 314e432eb2d967cf733b82bdbbe35231
Pragma: no-cache
content-length: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9E70 0
0 63ms
63ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJ6zRY68adThqvRraYlUkEsPsBofPdn8snOU9tJXKRVG71v-VKMn06TY04vlJGk_8FMHoxzWa1XJuzjDpdYBFr3kmx29VpDGctLlKecsUWzEpXub9Zdei1GGB6-BAbJM18Tj6SgGIzsMqwGrFPZGRHUq9tBjcsBB89ytM9wc449AQq81HnzPsJbasdIjjE3wPxKk8Xt6L5LiJbhs7iC6SaWHpqkH5ho7aeziRQQCUjC_qUA8yFOx045IZSo5BsGO3Gf9HTVs4xANYc4gS1H7DYpP6DcQQazJQtKFC1aYap3Ri6elWdQ4EMDJfcpj_bLWHO38shQ9iiHw79U6K5r-MEGD45d3MfCUxCD9Fuv7t4SfU1JRDIvgbsumG-LpRc7Gp4iRkoIr0WhpnTbCBqllhbBb4mi0T2-KOd7rPdc2OfKE-SNZyTRhayH-_wbZ3k_1rZRRzbzycPVOSo21dRRkD3oZxdHWXksDI0QtcMwUvGt7dMUSBJINl6wug8mSDadm6c7fP_7hiUGY26tdtyZOcs2t3CQuxOM-6EqARJe3RbPg_D-sWSnbQJ25NnD8vG433r2dFVaB3YExity0pYUY3kfYiVYEwgDQ&sai=AMfl-YSqvGIFsmEGDKU-oqRsG_TDA36Jz6-uvYA7dzsAhJOrWRC30zKIXDLnrLzYInFWtVsnXq-5YGHOQW--jbJLE5NSQyFTH0yJzl82JN7G5zwI1CirjR9_arXZcULY&sig=Cg0ArKJSzCOXPEBLw-bIEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 01:50:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 693B 0
917 B 112ms
111ms Script
text/html 68.67.160.24
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.45.122; 146.70.45.122; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 180ab6cd-eb2f-44fe-82d6-4c3b76bd9d09
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame D440 19 KB
7 KB 148ms
49ms Script
text/javascript 104.16.79.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.79.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 93626db7ba6531ec-MIA
access-control-allow-origin: *
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 144ms
143ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

813f3cb8d174ecba72113d0b7695b2aeccb4e67f40d089a55a9f090c7aca7b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame D440 4 KB
1 KB 121ms
119ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8b0ca6e11a99d5a5759ac17facf8b8fd4ea3596b456e529de8c9d997e44b8f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 93626db72da0a658-MIA
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 7AD6 2 KB
1 KB 57ms
56ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&bundle=w-UN-l9LR056WnlRdFl0ZjFSNkJqdm1KVEpSYzJCZkt6RERvVngxd1J0QmtORiUyQmR0QmowTDFCVnpGckdUWUIlMkJ4UXYwc0V5U0NodG1CTWZpR2JFbUVGQjdVNTBVQzMzdmpTeWJ3MTRpbDRIZHlMWlU4bnlVT1l6SlRZeXAxJTJGajFjcVBzbA&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1389882c53e1d4318b44f51126de737432d8fab147a4e2d5631b7e6c20b6700b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1875131
expires: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

sync
odr.mookie1.com/t/v2/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=TmieNF9Ec1hOTWRqU1lSR2xKa3d0dERwZEpBR0NVc2MzZVA4OE5FdjlsWVF0UXZBJTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-OgQxvZ8rym8udzkw...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=TmieNF9Ec1hOTWRqU1lSR2xKa3d0dERwZEpBR0NVc2MzZVA4OE5FdjlsWVF0UXZBJTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-OgQxvZ8rym...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=ab08096d-bc28-4942-942e-10897356bdf6&ssp=criteo&gdpr=0&gdpr_consent=

43 B
632 B

157ms
56ms

Image
image/gif

35.190.90.30
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=ab08096d-bc28-4942-942e-10897356bdf6&ssp=criteo&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.190.90.30 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 30.90.190.35.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-application-context: application
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-length: 43
content-type: image/gif;charset=UTF-8
server: Apache

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=ab08096d-bc28-4942-942e-10897356bdf6&ssp=criteo&gdpr=0&gdpr_consent=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:18 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3d1imOR19rZ0ZmRmkyYyUyRiUyQkdTdzdNNjNJRnBaZEx2VXA0UGU3ZlIySjZjWHBsYTVTbyUzRA%26u%3d%24UID&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=1imOR19rZ0ZmRmkyYyUyRiUyQkdTdzdNNjNJRnBaZEx2VXA0UGU3ZlIySjZjWHBsYTVTbyUzRA&u=280266010643178489&gdpr=0&gdpr_consent=

0
142 B

277ms
121ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=1imOR19rZ0ZmRmkyYyUyRiUyQkdTdzdNNjNJRnBaZEx2VXA0UGU3ZlIySjZjWHBsYTVTbyUzRA&u=280266010643178489&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Sat, 26 Apr 2025 01:50:18 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://ssp-sync.criteo.com/user-sync/match?p=1imOR19rZ0ZmRmkyYyUyRiUyQkdTdzdNNjNJRnBaZEx2VXA0UGU3ZlIySjZjWHBsYTVTbyUzRA&u=280266010643178489&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.45.122; 146.70.45.122; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 8eda5669-8eb7-4660-aae9-845f6e4d3311
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-OgQxvZ8rym8udzkwRx527kuuBwB6QFpBZgobeA&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
https://ssp-sync.criteo.com/user-sync/match?p=7XCGwF9FTWVkNmxqYTJpaVBFWU16RDU0cXNUZDg1ZDUlMkJHOWpnbFU2T3dUdGpQemslM0Q&u=CAESENT4jZWd3FChDDM9bRcQGxk&gdpr=0&gdpr_consent=&google_cver=1

0
141 B

280ms
123ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=7XCGwF9FTWVkNmxqYTJpaVBFWU16RDU0cXNUZDg1ZDUlMkJHOWpnbFU2T3dUdGpQemslM0Q&u=CAESENT4jZWd3FChDDM9bRcQGxk&gdpr=0&gdpr_consent=&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Sat, 26 Apr 2025 01:50:18 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/match?p=7XCGwF9FTWVkNmxqYTJpaVBFWU16RDU0cXNUZDg1ZDUlMkJHOWpnbFU2T3dUdGpQemslM0Q&u=CAESENT4jZWd3FChDDM9bRcQGxk&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 395
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3939934405842465097

0
144 B

240ms
124ms

Image
text/plain

74.119.117.39
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3939934405842465097

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3939934405842465097
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 26 Apr 2025 01:50:32 GMT

GET e805be652c9053b8f771665f0ac3c361.gif
cs.admanmedia.com/ 0
0

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D440
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D%24%7BUID%7D
https://elb.the-ozone-project.com/setuid?bidder=openx&uid=6d2de286-c8dc-436b-98d7-90da4f51fe38

0
279 B

96ms
96ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=openx&uid=6d2de286-c8dc-436b-98d7-90da4f51fe38
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93626db83f56a658-MIA
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=openx&uid=6d2de286-c8dc-436b-98d7-90da4f51fe38
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
vary: Origin

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 326ms
323ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

9a1bc2ae45b515bf74c14b5bd424ff40f3f02180d3d573d524e33ba39586a5e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/json
vary: Origin

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 63ms
63ms Fetch
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f155.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2 200 controller.min.js Show response
secure.cdn.fastclick.net/js/jil/3/ Frame 292D 1009 B
667 B 317ms
124ms Script
application/javascript 23.12.78.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/jil/3/controller.min.js
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.12.78.89 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-12-78-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1b488b53851ff77e207b66240535415151574760fd474002d00ba7ba181afd8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
etag: "3f1-59aa070795d00-gzip"
accept-ranges: bytes
content-length: 513
date: Sat, 26 Apr 2025 01:50:19 GMT
last-modified: Thu, 26 Dec 2019 19:32:36 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 ad-info.js Show response
s-usweb.dotomi.com/assets/js/adapters/1.1.4/ Frame 292D 9 KB
4 KB 299ms
85ms Script
application/javascript 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://s-usweb.dotomi.com/assets/js/adapters/1.1.4/ad-info.js?path=https://legal.epsilon.com/adchoices/&trust=dotomissl01&cw=758&ch=921&ctype=1&forced=0&ms=21&clogo=2000.png&cid=2621&loader_ver=current&purl=http%3A%2F%2Fwww.conversantmedia.com%2Flegal%2Fprivacy&cname=Conversant%20Media&politicalAd=false&dtm_host=login.dotomi.com&lang=en-us&loc=US&plc=tr&w=160&h=600&optout_info=gfpvc70COrF_Nnp5NztBA
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 3a042645d107c41a9709e7198165e8f2022ba2aad6a804515a6d77798a4369f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: HIT
content-encoding: gzip
etag: W/"67a50fde-23ec"
x-cache-date: Sat, 26 Apr 2025 01:45:30 GMT
access-control-allow-origin: *
content-length: 3498
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx
last-modified: Thu, 06 Feb 2025 19:39:10 GMT

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 292D 43 B
228 B 62ms
48ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?dtmid=712606650934641350&utype=0&magic=1&trid=1119080698636045545&comId=2621&msgCampId=40048300&tid=750586341&ptid=700079378&pnid=15900&pid=9252682&parentMsgId=40048300&rt=1&supplyType=1&dtm_server_id=1602&ms=21&icb=0&dtm_user_ip=146.70.45.122&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&assigned_creative_id=750586341&fpc=0&etype=3101
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 292D 43 B
228 B 133ms
119ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?dtmid=712606650934641350&utype=0&magic=1&trid=1119080698636045545&comId=2621&msgCampId=40048300&tid=750586341&ptid=700079378&pnid=15900&pid=9252682&parentMsgId=40048300&rt=1&supplyType=1&dtm_server_id=1602&ms=21&icb=0&dtm_user_ip=146.70.45.122&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&assigned_creative_id=750586341&fpc=0&etype=3108
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 292D 43 B
228 B 134ms
121ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?dtmid=712606650934641350&utype=0&magic=1&trid=1119080698636045545&comId=2621&msgCampId=40048300&tid=750586341&ptid=700079378&pnid=15900&pid=9252682&parentMsgId=40048300&rt=1&supplyType=1&dtm_server_id=1602&ms=21&icb=0&dtm_user_ip=146.70.45.122&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&assigned_creative_id=750586341&fpc=0&etype=3107
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 292D 43 B
228 B 133ms
120ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?dtmid=712606650934641350&utype=0&magic=1&trid=1119080698636045545&comId=2621&msgCampId=40048300&tid=750586341&ptid=700079378&pnid=15900&pid=9252682&parentMsgId=40048300&rt=1&supplyType=1&dtm_server_id=1602&ms=21&icb=0&dtm_user_ip=146.70.45.122&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&assigned_creative_id=750586341&fpc=0&etype=3105
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
server: nginx

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 292D 170 B
188 B 70ms
63ms Image
image/png 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=core_dbm&google_hm=AAAFprGU5Se3yv8AAAAqAAAAAAA

Requested by

Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-156-207.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 292D
Redirect Chain

https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQAEp7CV5Ca2ywJAiHrLAQELPAEBAQCXbsjPsAEBAJduyM-w
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=7&google_push=&retry=
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=7&google_push=&retry=true
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-7-e778ff8d-a774-4b8b-8899-7a77bb9e788a

43 B
479 B

272ms
132ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-7-e778ff8d-a774-4b8b-8899-7a77bb9e788a

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: Z7BD3TMVQAWTQHPQZT3B
Content-Length: 43
Date: Sat, 26 Apr 2025 01:50:19 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-7-e778ff8d-a774-4b8b-8899-7a77bb9e788a
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
x-envoy-upstream-service-time: 34
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

GET
H2

204

current
lotame-match.dotomi.com/match/bounce/ Frame 292D
Redirect Chain

https://sync.crwdcntrl.net/qmap?c=18048&tp=EPSN&tpid=AQAEp7CV5Ca2ywJAiHrLAQELPAEBAQCXbsjPsAEBAJduyM-w&gdpr=false&gdpr_consent=&d=https%3A%2F%2Flotame-match.dotomi.com%2Fmatch%2Fbounce%2Fcurrent%3Fn...
https://lotame-match.dotomi.com/match/bounce/current?networkId=9253738&version=1&nuid=d59c9c3df8e940067a75b92c3dee8e42&gdpr=0

0
104 B

368ms
146ms

Image
text/plain

67.72.99.169
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://lotame-match.dotomi.com/match/bounce/current?networkId=9253738&version=1&nuid=d59c9c3df8e940067a75b92c3dee8e42&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 67.72.99.169 Ashburn, United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad05-nessy-float1.dotomi.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
date: Sat, 26 Apr 2025 01:50:19 GMT
pragma: no-cache
server: nginx

Redirect headers

expires: 0
cache-control: no-cache
location: https://lotame-match.dotomi.com/match/bounce/current?networkId=9253738&version=1&nuid=d59c9c3df8e940067a75b92c3dee8e42&gdpr=0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
pragma: no-cache

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 292D 42 B
598 B 200ms
83ms Image
image/gif 8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xNTc2ODAw&piggybackCookie=AQAEp7CV5Ca2ywJAiHrLAQELPAEBAQCXbsjPsAEBAJduyM-w&gdpr_consent=
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 25 Apr 2025 19:22:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 292D 42 B
1 KB 250ms
108ms Image
image/gif 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&expires=90&put=AQAEp7CV5Ca2ywJAiHrLAQELPAEBAQCXbsjPsAEBAJduyM-w&gdpr_consent=
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
Pragma: no-cache
content-length: 42
Content-Type: image/gif

GET
H3 200 rum
dsum-sec.casalemedia.com/ Frame 292D 43 B
763 B 128ms
125ms Image
image/gif 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AQAEp7CV5Ca2ywJAiHrLAQELPAEBAQCXbsjPsAEBAJduyM-w&gdpr_consent=
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HA8whncHWeWcNYdw919IuYwA5ZSwr8QxkxL2%2B9MMj3rfEonNLI4UYoMvbJ7pehxyHYgDUBaTU2pH0O2GPj7VlBThibPq2JbFKm7CdbRJLClN4ZyjXHoSW%2BgQ47Ncg8ERwJSUwyOO3suMvw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db9ae447b6f-MIA
content-length: 43
server: cloudflare

GET
H2 200 xuid
eb2.3lift.com/ Frame 292D 37 B
475 B 222ms
83ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAEp7CV5Ca2ywJAiHrLAQELPAEBAQCXbsjPsAEBAJduyM-w&gdpr_consent=
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

GET
H2 200 sd
us-u.openx.net/w/1.0/ Frame 292D 43 B
128 B 49ms
46ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072954&val=AQAEp7CV5Ca2ywJAiHrLAQELPAEBAQCXbsjPsAEBAJduyM-w&gdpr_consent=
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
vary: Accept

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 292D 9 KB
4 KB 276ms
89ms Script
text/javascript 23.44.129.52
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=2198896&cmp=DV184445&sid=conversant&plc=DV-CNVR-IQM_Brand_View&adsrv=8&advid=3819603&dvtagver=6.1.src&btreg=[CV_UNIQUE_ID]&ppid=230&autt=1&c4=1&aubndl=&c1=2621&aucmp=40048300&pltfrm=9252682&ausite=561707207&audvc=2&auxch=[EXCHANGE_ID]&c2=273&c3=[AD-HOC_TEST_VALUE]&auevent=1119080698636045545&auip=[BID_IP_ADDRESS]&DVPX_PP_AUCTION_UA=[URL-ENCODED_BID_USER-AGENT]&turl=https://paint.toys/oil
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.129.52 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-44-129-52.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e162e88cfbc6d5069fdb25ceaaf43a3de029d2af2268470d103a66dd5aede643

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "c92a5da50bcd5ec17e2c79f6b3a11d58"
Connection: keep-alive
Expires: Sat, 26 Apr 2025 02:05:19 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 3319
Date: Sat, 26 Apr 2025 01:50:19 GMT
Last-Modified: Wed, 23 Apr 2025 12:30:51 GMT
Content-Type: text/javascript

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 292D 472 KB
95 KB 323ms
129ms Script
text/javascript 23.44.129.52
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: iad-usadmm.dotomi.com
URL: https://iad-usadmm.dotomi.com/fetch/banner/jsonp?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&cturl=https%3A%2F%2Fozoneproject-d.openx.net%2Fw%2F1.0%2Frc%3Fts%3D2DAABBgABAAECAAIBAAsAAgAAAfQcGAoxa280SnZkTnBKHBabyJWS8q_Li8ABFpvjjryC6s2WxgEAHBa2n8L8vca4sUkWr97Q2r3Sp7y4AQAWru_hgA0VBjgkYjg0YTdkOWMtNWQ3YS00YWUyLTg0ZTQtYmM5NDg2YmNhNzNlSQwALBwVAgAcFQIAHBUIABwVAgB8HBUIABwVAgAYDDEuMzMxMDQ1NzA5NAAAHCau5NeXBBUENo7j15cEFuCl14MEJQIVAqbwBRa0BBbwBRbIARaWARbIARaWARbcBhbwBRbwBQAcHCwWgLGKpLvsg60qFuuytdnn4oDnpQEAABa62ZiABBaS2fWCBBaU_KKDBBaI3vWCBBUYHBSwCRTAAgAVBCbcBhbcBhbcBhE1DibcBjQIACwsFqyI2r6Pgqzj4QEW0b68ibGQjZPxAQAWru_hgA0GKLrZmIAEFpLZ9YIEFoje9YIEFpT8ooMEGA4yNjIxXzc1MDU4NjM0MRYAFtwGJQQWbBgKY29udmVyc2FudBUCoREYBU9YLUdCDHoUtAkUxAIAFgIYA3J0YgAcNQYYDU9YLVhQVC1pa1dMTnQWEFwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAWkumOlwQWkOmOlwQADDw4HGxvd2VzLmNvbUBpbnRlcm5ldGFsZXJ0cy5vcmcAAAA%26r%3D&supplier_domain=openx.net&assigned_creative_id=750586341&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&tz=-600&vtime=0&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.129.52 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-44-129-52.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 23f79a4e3359cbb67fc7cb382ca200c4951f3c0ccf9aa2eec11178248cd2b000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "111bae36c7651852434b5af08b42eeaf"
Connection: keep-alive
Expires: Sat, 26 Apr 2025 02:05:19 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 96372
Date: Sat, 26 Apr 2025 01:50:19 GMT
Last-Modified: Wed, 23 Apr 2025 12:30:55 GMT
Content-Type: text/javascript

GET
H2 200 impression
iad-usadmm.dotomi.com/event/ad/web/win/ Frame 9E70 43 B
228 B 129ms
120ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/web/win/impression?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&cgcb=-1&ms=21&count_cost=1&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&pubUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&assigned_creative_id=750586341
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 131ms
123ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?dtmid=712606650934641350&utype=0&magic=1&trid=1119080698636045545&comId=2621&msgCampId=40048300&tid=750586341&ptid=700079378&pnid=15900&pid=9252682&parentMsgId=40048300&rt=1&supplyType=1&dtm_server_id=1602&ms=21&icb=0&dtm_user_ip=146.70.45.122&iblob=h-aemhlcCOmZyun1vvHDDxD1hKf-5jIaFmh0dHBzOi8vcGFpbnQudG95cy9vaWwiCTU2MTcwNzIwNzCQ_v________8BUgdkZXNrdG9wWgdVbmtub3dueACCAQ0xNDYuNzAuNDUuMTIyoAEBqgEJNTQwNzMxNzYwsgEESUFCObgBAcAB6sX82enk3O0EyAH___________8B0AEA4AEE4AGzkbcB4AGykbcB4AG1lLcB4AGzlLcB4AHpj7cB4AHPlrcB4AHOlrcB4AHslbcB4AHlkrcB4AHdkrcB4AG_k7cB4AGflLcB4AHJnLcB4AG-k7cB4AHHnLcB4AHZlbcB4AHNlrcB4AG_nLcB4AGRlEvgAc-VtwHgAeiRtwHgAZuKS-ABp5y3AeABzJu3AeAB5pe3AeAB5Je3AeABiZ23AeABvpW3AeABh523AeABwpu3AeABwZu3AeABwJu3AeABlZK3AeABpYxL4AGslbcB4AHJl7cB4AEJ4AG_lEvgAdyTtwHgAb2XtwHoAbCc84Dqy970tAHzAQoCVVMSAlVTGP4BIgJGTCgKMgVNSUFNSThdQLECSJAEUJAEWgUzMzEzMmDsggJtcT3OQXVIYaDCehJMRVZFTCAzIFBBUkVOVCBMTEOSAQRXSUZJ9AH7AQoCVVMSAlVTGP4BIgJTQygpOJovUPsDWgUyOTkyNvwBggIJNTYxNzA3Mjg3iAL___________8BmAIBoAIAqAIAsAIAwAICygI7MTU1OTc3NjYyOXw0Mjg0NzY2MTV8MTM2MjE4NTQ0M3wyNTU2Mzk2Nzh8MTM5NzEyNjk2MXwwfC0xfDDoAhLzAgirriMQ69uD9eUyGgYwLjk4MjkhAAAAAAAAAEApAAAAAAAA8D_0AvkCQBTdwQMWhL-BA3E7NCxG3e8_iQNXPWAeMuXgP5EDw_UoXI_C5T-ZA5A3LJAdR9Y_oQPeUkYRKnnGPqkDAAAAAAAA8D-wAwHyAwNVU0T5A4eZhY_rc-8_gQQfhetRuJ4hQIkEhetRuB6F2z-RBGZmZmZmZtY_qATBzJgHsATaAbkEpDOWSv72lUDBBNV21Aa426g_ggUFTGludXiIBQCQBQKYBQOoBQCxBQAAAAAAAAAAuQUAAAAAAAAAAMEFAAAAAAAA8L_JBQAAAAAAAAAA0AUA6QUAAAAAAAAAAPEFAAAAAAAAAAD5BQAAAAAAAAAAggYCSVCYBv___________wGoBgCwBgG4BgDABgLLBggJEADMBtgGAOoGAmVu8AYE-QautmJ_2T3ZP4IHB2RlZmF1bHSIBwCYBwE&assigned_creative_id=750586341&fpc=0&etype=3106
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
server: nginx

GET
H3

200

B33006988.413513735;dc_pre=CPzUx-LK9IwDFTUHaAgdcVEGmA;dc_trk_aid=605898225;dc_trk_cid=229234850;kw=mdv_size;ord=1119080698636045545;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7...
ad.doubleclick.net/ddm/trackimp/N481402.4765132APEXGUARANTEED/ Frame 9E70
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N481402.4765132APEXGUARANTEED/B33006988.413513735;dc_trk_aid=605898225;dc_trk_cid=229234850;kw=mdv_size;ord=1119080698636045545;dc_lat=;dc_rdid=;tag_for_chil...
https://ad.doubleclick.net/ddm/trackimp/N481402.4765132APEXGUARANTEED/B33006988.413513735;dc_pre=CPzUx-LK9IwDFTUHaAgdcVEGmA;dc_trk_aid=605898225;dc_trk_cid=229234850;kw=mdv_size;ord=111908069863604...

42 B
65 B

76ms
75ms

Image
image/gif

142.250.31.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N481402.4765132APEXGUARANTEED/B33006988.413513735;dc_pre=CPzUx-LK9IwDFTUHaAgdcVEGmA;dc_trk_aid=605898225;dc_trk_cid=229234850;kw=mdv_size;ord=1119080698636045545;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=;kw=C2621_LI40048300_CR750586341;ltd=;dc_tdv=1?

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.31.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f148.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Sat, 26 Apr 2025 01:50:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://ad.doubleclick.net/ddm/trackimp/N481402.4765132APEXGUARANTEED/B33006988.413513735;dc_pre=CPzUx-LK9IwDFTUHaAgdcVEGmA;dc_trk_aid=605898225;dc_trk_cid=229234850;kw=mdv_size;ord=1119080698636045545;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=;kw=C2621_LI40048300_CR750586341;ltd=;dc_tdv=1?
pragma: no-cache
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H2

200

xuid
eb2.3lift.com/ Frame C973
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=49c3faef-6035-48d8-870a-95c452414c25&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

89ms
88ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=49c3faef-6035-48d8-870a-95c452414c25&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=49c3faef-6035-48d8-870a-95c452414c25&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Sat, 26 Apr 2025 01:50:18 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame C973
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEMoKFsdqSdAW6xAwESPqNJI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
474 B

95ms
94ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEMoKFsdqSdAW6xAwESPqNJI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEMoKFsdqSdAW6xAwESPqNJI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Sat, 26 Apr 2025 01:50:18 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C973
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE5MjMzNjU5ODAwNjc0MDUxMTQwNQ%3D%3D

170 B
188 B

66ms
65ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE5MjMzNjU5ODAwNjc0MDUxMTQwNQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-222-234-153.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 26 Apr 2025 01:50:19 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE5MjMzNjU5ODAwNjc0MDUxMTQwNQ%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:50:18 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame C973
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE5MjMzNjU5ODAwNjc0MDUxMTQwNQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

76ms
75ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Sat, 26 Apr 2025 01:50:19 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame C973 0
249 B 172ms
123ms Image
text/plain 150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1192336598006740511405&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: D51DD9D5A6034CCFA3DEFC58A301A1D0 Ref B: MIA301000108053 Ref C: 2025-04-26T01:50:19Z
x-li-fabric: prod-lor1
x-li-uuid: AAYzpKxTP+OAofWMqiPb8g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT

GET
H/1.1

200
OK

35759
i.liadm.com/s/ Frame C973
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1192336598006740511405
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=49c3faef-6035-48d8-870a-95c452414c25

43 B
611 B

57ms
57ms

Image
image/gif

3.222.234.153
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=49c3faef-6035-48d8-870a-95c452414c25

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

HTTP/1.1

Server

3.222.234.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 0d2c982dfdcb827d
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Sat, 26 Apr 2025 01:50:19 GMT
Content-Type: image/gif

Redirect headers

location: https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=49c3faef-6035-48d8-870a-95c452414c25
content-length: 215
date: Sat, 26 Apr 2025 01:50:19 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame C973
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1192336598006740511405?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-XFpb9j1E2oQO.gmPl2G1AdInDd3cM7xfJQ6t1_4aPw--~A&dongle=0883

37 B
474 B

85ms
83ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-XFpb9j1E2oQO.gmPl2G1AdInDd3cM7xfJQ6t1_4aPw--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-XFpb9j1E2oQO.gmPl2G1AdInDd3cM7xfJQ6t1_4aPw--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 26 Apr 2025 01:50:18 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame C973 42 B
690 B 277ms
127ms Image
image/gif 150.171.27.10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1192336598006740511405&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "15235cb149b5db1:0"
x-msedge-ref: Ref A: 40DC083B1D854D84BE43E09021D92054 Ref B: MIA301000104021 Ref C: 2025-04-26T01:50:19Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: image/gif
last-modified: Thu, 24 Apr 2025 18:50:05 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame C973
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=4bf098b690c048b&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAAnDSTulrscQJsGXznAQEBAQEBAQCXbsjR0gEBAQEBAQEB&expiration=1745718619&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

64ms
62ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAAnDSTulrscQJsGXznAQEBAQEBAQCXbsjR0gEBAQEBAQEB&expiration=1745718619&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAAnDSTulrscQJsGXznAQEBAQEBAQCXbsjR0gEBAQEBAQEB&expiration=1745718619&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame C973
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-ed2c7745-233e-5d94-4e87-353671c6a34d$ip$146.70.45.122&dongle=4430

37 B
474 B

57ms
57ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-ed2c7745-233e-5d94-4e87-353671c6a34d$ip$146.70.45.122&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-ed2c7745-233e-5d94-4e87-353671c6a34d$ip$146.70.45.122&dongle=4430
Content-Length: 139
Date: Sat, 26 Apr 2025 01:50:19 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 6996 20 KB
7 KB 55ms
54ms Document
text/html 23.54.45.11
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.45.11 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-45-11.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://elb.the-ozone-project.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=71234
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 26 Apr 2025 01:50:19 GMT
expires: Sat, 26 Apr 2025 21:37:33 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame ACBD 4 KB
5 KB 387ms
81ms Document
text/html 54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 04b5a35780a3950c7d1cb3a7b9a4aa611b5247cc9560dcacbc84c8031f6e0bd0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-type: text/html
date: Sat, 26 Apr 2025 01:50:19 GMT
server: istio-envoy
x-envoy-upstream-service-time: 3

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D440
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?us_privacy=pbs-ozone&gdpr=0&gdpr_consent=&s=189937&cb=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D0%26gdpr_consent%3D%26us_pr...
https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAw72cAoJI0AHdKJAZBS1wAA%261617

0
403 B

79ms
76ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAw72cAoJI0AHdKJAZBS1wAA%261617
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93626db9f934a658-MIA
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AgxCWYcL8sQr0AV8ggqT4FPRdwpVKI%2B10A5Sp%2BVbSpS%2Br246kSSpVJ1Nkvxv%2Bw4pcbswlj8dnIWa0nXTkBeK2UkGyHHGRRF%2BK%2Fhblay%2BTttpAjCeANNpz6BIoXZKGmv97nXeYINA"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 26 Apr 2025 01:50:19 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aAw72cAoJI0AHdKJAZBS1wAA%261617
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93626db96e0cf471-MIA
content-length: 0
server: cloudflare

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame B2D5 0
128 B 62ms
57ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 25 Apr 2025 19:42:07 GMT
server: nginx

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 6996 2 KB
2 KB 56ms
55ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=26759661&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: b40907c1b0dcd790af0f46d46785dbc75d8826d264627bb13a930f91b65fdc6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 1919
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/html; charset=UTF-8

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 20D3 0
339 B 278ms
115ms Document
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Sat, 26 Apr 2025 01:50:19 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3DBD
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=7Sx3RSM-XZROhzU2ccajTZJGLXo&gdpr=0&gdpr_consent=

42 B
381 B

59ms
56ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=7Sx3RSM-XZROhzU2ccajTZJGLXo&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:50:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Sat, 26 Apr 2025 01:50:19 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=7Sx3RSM-XZROhzU2ccajTZJGLXo&gdpr=0&gdpr_consent=

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 6CEC
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
153 B

38ms
37ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAw72wAMuVQDRgBh
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1791
cache-control: no-cache
content-length: 85
content-type: image/png
date: Sat, 26 Apr 2025 01:50:19 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 8733
x-robots-tag: noindex
x-served-by: cache-mia-kmia1760052-MIA
x-timer: S1745632219.309903,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aAw72wAMuVQDRgBh
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-mia-kmia1760052-MIA
x-timer: S1745632219.187248,VS0,VE27

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame A384
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978758910196277594

42 B
194 B

66ms
65ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978758910196277594
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:50:19 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:19 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978758910196277594
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame C314
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir?partneruserid=AAF5jk7QGHgAABwWGFrsug&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr_consent%3D%26bee_sync_partners...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=pm&bee_sync_hop_count=1&userid=2104995757754691308&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAF5jk7QGHgAABwWGFrsug&gdpr=0&gdpr_consent=

42 B
228 B

73ms
72ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAF5jk7QGHgAABwWGFrsug&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 26 Apr 2025 01:50:19 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:19 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAF5jk7QGHgAABwWGFrsug&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 40BC
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://sync.aralego.com/bsw_sync?ucf_nid=par-E2B44D84BBBDED8A0B297323E4B4A68&dsp_id=445&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=ab08096d-bc28-4942-942e-10897356bdf6&gdpr=0&gdpr_consent=&gdp...
https://x.bidswitch.net/sync?dsp_id=445&user_id=c659079d-e519-3d84-8e91-8289686610f0&ssp=pubmatic&bsw_param=ab08096d-bc28-4942-942e-10897356bdf6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=ab08096d-bc28-4942-942e-10897356bdf6&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7758347220123289199

42 B
323 B

58ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7758347220123289199
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 25 Apr 2025 19:40:45 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
expires: -1
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7758347220123289199
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 setuid Show response
elb.the-ozone-project.com/ Frame 2461 0
391 B 106ms
102ms Document
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/setuid?bidder=pubmatic&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=58D4D86C-1A37-49F0-88F8-7CE261999DE3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&predirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93626db9f932a658-MIA
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
expires: 0
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET g.pixel
aa.agkn.com/adscores/ Frame 6996 0
0

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame 6996 49 B
221 B 302ms
148ms Image
image/gif 54.243.204.121
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.204.121 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-243-204-121.compute-1.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 6996
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=58D4D86C-1A37-49F0-88F8-7CE261999DE3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=001943de-731d-4bc3-a766-592bc2d2ab24%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=49c3faef-6035-48d8-870a-95c452414c25&ttd_puid=001943de-731d-4bc3-a766-592bc2d2ab24%2C%2C

95 B
124 B

56ms
55ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=49c3faef-6035-48d8-870a-95c452414c25&ttd_puid=001943de-731d-4bc3-a766-592bc2d2ab24%2C%2C

Requested by

Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=49c3faef-6035-48d8-870a-95c452414c25&ttd_puid=001943de-731d-4bc3-a766-592bc2d2ab24%2C%2C
content-length: 359
date: Sat, 26 Apr 2025 01:50:19 GMT
server: Kestrel

GET
H2

200

sync
pippio.com/api/ Frame 6996
Redirect Chain

https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=58D4D86C-1A37-49F0-88F8-7CE261999DE3
https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D
https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3939934405842465097
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=53018a43-eca9-4753-b85b-fa36c02047e4
https://p.rfihub.com/cm?pub=39342&in=1&userid=6718da42-f632-45b5-847f-e1432e22bd59%3A1745632219.8544078&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D6718da42-f632-45b5...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=978758910196277594&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D6718da4...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=6718da42-f632-45b5-847f-e1432e22bd59%3A1745632219.8544078&pid=500040&it=1&iv=6718da42-f632-45b5-847f-e1432e22bd59%3A1745632219.8544078&_=174...
https://pippio.com/api/sync?it=1&pid=500040&_=1745632219.8591616&iv=6718da42-f632-45b5-847f-e1432e22bd59:1745632219.8544078

42 B
344 B

195ms
133ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1745632219.8591616&iv=6718da42-f632-45b5-847f-e1432e22bd59:1745632219.8544078
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1745632219.8591616&iv=6718da42-f632-45b5-847f-e1432e22bd59:1745632219.8544078
Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:20 GMT
trace-id: dffc1d91c1421b2c
Request-Time: 1
Connection: keep-alive

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6996
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=c9c8840d-a60c-4c62-9e40-7fa7bb4026c7-680c3bda-5553&gdpr=0&gdpr_consent=

42 B
387 B

65ms
64ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=c9c8840d-a60c-4c62-9e40-7fa7bb4026c7-680c3bda-5553&gdpr=0&gdpr_consent=
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=c9c8840d-a60c-4c62-9e40-7fa7bb4026c7-680c3bda-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
server: A

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 6996 0
163 B 232ms
79ms Image
text/plain 54.88.122.233
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.88.122.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-88-122-233.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 26 Apr 2025 01:50:19 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 6996
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=785e739b896106aa&is_secure=true&networkId=17100&version=1&nuid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADhSO7gIT_VgJnSWdXAQEBAQEBAQCXbsjQwwEBAQEBAQEB&expiration=1745718619&nuid=58D4D86C-1A37-49...

42 B
452 B

60ms
58ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADhSO7gIT_VgJnSWdXAQEBAQEBAQCXbsjQwwEBAQEBAQEB&expiration=1745718619&nuid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADhSO7gIT_VgJnSWdXAQEBAQEBAQCXbsjQwwEBAQEBAQEB&expiration=1745718619&nuid=58D4D86C-1A37-49F0-88F8-7CE261999DE3&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
pragma: no-cache
server: nginx

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6996
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3939934405842465097&gdpr=0&gdpr_consent=&us_privacy=

1 B
244 B

70ms
62ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3939934405842465097&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3939934405842465097&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 26 Apr 2025 01:50:13 GMT

GET
H2 200 icon-tr.png
s-usweb.dotomi.com/assets/img/ Frame 292D 1 KB
1 KB 98ms
97ms Image
image/png 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com/assets/img/icon-tr.png
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 7f70b26727a53274a714a4c981ac19f8f8e59dc5f5029e49b430a0ac41dbbc8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-length: 1370
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/png
server: nginx

GET
H2 200 icon-tr-full.png
s-usweb.dotomi.com/assets/img/en-us/ Frame 292D 2 KB
2 KB 101ms
100ms Image
image/png 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com/assets/img/en-us/icon-tr-full.png
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 243dc59102377a5e8689e8b3cc0133615020f035d5e6dd7e1c2aadcac2b78e3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
etag: "67a50fda-653"
x-cache-date: Thu, 17 Apr 2025 19:44:48 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1619
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/png
last-modified: Thu, 06 Feb 2025 19:39:06 GMT
server: nginx

GET
H2 200 current
usadmm-ds.dotomi.com/event/ad/lifecycle/ Frame 292D 43 B
229 B 378ms
150ms Image
image/gif 159.127.43.73
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://usadmm-ds.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=3000&vtime=916
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.43.73 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad03-nessy-float1.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H/1.1 200
OK dv-measurements7690.js Show response
cdn.doubleverify.com/ Frame 396C 448 KB
87 KB 77ms
76ms Script
text/javascript 23.44.129.52
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements7690.js
Requested by: Host: qwxz.avasporelight.com
URL: https://qwxz.avasporelight.com/gttycnnfnaftmyoqjbcsafrmoclecjRdGloVWlOWE1PSlU5S0l5VzhzbjctMjY5MC0yNjcxNTk3MS0xMDA3MDI3OC0zODM2LW5VaVRXd2R0eExBQjZCdGl3UUZy/774ska3lc1jirm9ezu647utwepgmwj9qn/uqyvrd/vi0vpwevtgbcl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.129.52 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-44-129-52.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d990846fd230b49f80eb9e7e5f155fad2ad1e25add9492b5a070ee57ba9a569d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=31536000
Content-Encoding: br
ETag: "49a83720c9919919968559350de51641"
Connection: keep-alive
Expires: Sun, 26 Apr 2026 01:50:19 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 88897
Date: Sat, 26 Apr 2025 01:50:19 GMT
Last-Modified: Wed, 23 Apr 2025 09:15:17 GMT
Content-Type: text/javascript

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D440
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
https://elb.the-ozone-project.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=ab08096d-bc28-4942-942e-10897356bdf6

0
494 B

85ms
77ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=ab08096d-bc28-4942-942e-10897356bdf6
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93626dbbcb0aa658-MIA
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=ab08096d-bc28-4942-942e-10897356bdf6
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:19 GMT

GET
H2 200 client.min.js Show response
secure.cdn.fastclick.net/js/jil/3/ Frame 625F 1 KB
682 B 56ms
54ms Script
application/javascript 23.12.78.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/jil/3/client.min.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.12.78.89 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-12-78-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7dd42465bc7ddec6f5e26a14cab3a7bf6df22f582e54063e78742111685d44b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
etag: "41a-59aa070795d00-gzip"
accept-ranges: bytes
content-length: 529
date: Sat, 26 Apr 2025 01:50:19 GMT
last-modified: Thu, 26 Dec 2019 19:32:36 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 0f7c49eacd88c9b5034265eda7272d60.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 8 KB
2 KB 64ms
62ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/0f7c49eacd88c9b5034265eda7272d60.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c79fc56796fb3335e7cf23c53efb3ada08acbb51ba56ad9d02b8ee89514a54c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa07-1f42"
x-cache-date: Wed, 10 Jul 2024 20:58:54 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2363
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:31 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 b67ad0936102bcd6d5597d1b43b382c5.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 9 KB
3 KB 58ms
57ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/b67ad0936102bcd6d5597d1b43b382c5.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cb22575260fa4a4aef5407852ce7150ba91a0e3d5a999002b325ed363d9926db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa08-2267"
x-cache-date: Tue, 23 Jul 2024 04:06:14 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3217
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 5701c5bd074412fac22fd0f9f879a1ef.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 8 KB
3 KB 59ms
58ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/5701c5bd074412fac22fd0f9f879a1ef.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 368882dac6cdb9d069ccb0bae4dd8040550bf9d119dc50af05323ac937cf29da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa08-1ee4"
x-cache-date: Wed, 10 Jul 2024 20:58:54 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3179
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 303ebb1c299495c0f59c308f2151aed3.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 9 KB
4 KB 68ms
65ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/303ebb1c299495c0f59c308f2151aed3.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: df51bacf30859139d65a07298ba6989dbd51eee7638d6e382c2a86f9b13cd4c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa08-2399"
x-cache-date: Wed, 10 Jul 2024 20:58:54 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3507
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 2afbc483c0fb494593e38ee4ce1cf39e.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 2 KB
1 KB 126ms
105ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/2afbc483c0fb494593e38ee4ce1cf39e.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 93069de24889f5e0af4cb40328f8512e29f72e3254fac113c493bd9a69d5750a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa08-99b"
x-cache-date: Fri, 01 Nov 2024 09:17:44 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1056
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 05a5f52e257032e6e6e73ab2f369d2e0.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 2 KB
1 KB 127ms
105ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/05a5f52e257032e6e6e73ab2f369d2e0.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 6a98903d3c88ad40a37c22a8948780bd02a9a47f33279c98452b1d0e8b19622d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa08-788"
x-cache-date: Fri, 01 Nov 2024 09:17:44 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 951
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 d51fca2530c81ef2f645078e41611cd9.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 371 B
452 B 128ms
127ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/d51fca2530c81ef2f645078e41611cd9.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c0ecc06f0e7921de7dffc10d08f09f76b093df92ae32826b6c6e98f96abac584

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa09-173"
x-cache-date: Sat, 21 Sep 2024 04:50:37 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 257
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:33 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 a5f077aa3e8af55f6e90e20074a078d9.jpg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 30 KB
30 KB 83ms
61ms Image
image/jpeg 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/a5f077aa3e8af55f6e90e20074a078d9.jpg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: de71bebb9a08c2d1c43dea995f415b58a3adcaa71f67c20752e3f962e188debc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
etag: "6670aa09-78f1"
x-cache-date: Wed, 10 Jul 2024 20:58:54 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30961
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/jpeg
last-modified: Mon, 17 Jun 2024 21:26:33 GMT
server: nginx

GET
H2 200 bb87a7b12b2381fe91751c11ebb7d484.jpg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 30 KB
30 KB 130ms
108ms Image
image/jpeg 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/bb87a7b12b2381fe91751c11ebb7d484.jpg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 15fbc339019c7dcb8aa5eda8d816fce963b19b5469cd65ca60837b7c8c2dfc23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
etag: "6670aa09-787d"
x-cache-date: Thu, 19 Dec 2024 23:49:04 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30845
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/jpeg
last-modified: Mon, 17 Jun 2024 21:26:33 GMT
server: nginx

GET
H2 200 1c9488ef990a06c9704d0c3f846a4f89.jpg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 20 KB
20 KB 153ms
132ms Image
image/jpeg 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/1c9488ef990a06c9704d0c3f846a4f89.jpg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a10425bf4de081a6f8aa7bda064a038d4198f3115eeeeca6ed6ec8e53351e9e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
etag: "6670aa09-50f4"
x-cache-date: Tue, 12 Nov 2024 16:41:25 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20724
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/jpeg
last-modified: Mon, 17 Jun 2024 21:26:33 GMT
server: nginx

GET
H2 200 163114437d46a13f870c59f3ecf0ce33.svg
s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/ Frame 625F 273 B
386 B 164ms
144ms Image
image/svg+xml 184.25.44.193
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://s-usweb.dotomi.com//archiver/c8f/e32/3bd/c8fe323bd1297c3b602cc24da22f47496cdd33f6dab400f76bbcc20ec6cf90a6/images/163114437d46a13f870c59f3ecf0ce33.svg
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.44.193 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-44-193.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 20d4d132634ed30d33a133081e5c8402563b101f1f8dc3ff8d46015d51080ab1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache-status: MISS
content-encoding: gzip
etag: "6670aa0a-111"
x-cache-date: Wed, 09 Oct 2024 10:19:02 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 192
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/svg+xml
last-modified: Mon, 17 Jun 2024 21:26:34 GMT
server: nginx
vary: Accept-Encoding

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 292D 724 B
800 B 298ms
106ms Script
text/javascript 35.201.101.243
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=1&ttmms=25&ttfrms=31&brid=96&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTau%40%3A%3DTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JD&srcurlD=0&aUrlD=0&ssl=https:&dfs=19&ddur=401&uid=1745632219383790&jsCallback=dvCallback_1745632219383413&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7690&tgjsver=7690&lvvn=28&m1=96&refD=2&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&fwc=0&fcl=1392&flt=0&fec=127&fcifrms=27&brh=2&dvp_epl=174&noc=48&nav_pltfrm=Linux%20x86_64&ctx=32373518&cmp=33006988&sid=8938572&plc=413513735&adsrv=1&advid=6545267&turl=https://paint.toys/oil&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&mon=1&blk=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=1600806058547.3223&ee_dp_sukv=1600806058547.3223&dvp_tukv=29017221270.120487&ee_dp_tukv=29017221270.120487&dvp_tuid=1063805768027&jurtd=1627150551
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.101.243 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 243.101.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 89c22e3235cf5d6698907c8d84190e601268d17a387a80accb5fb38857a3ac57

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
Expires: 04/25/2025 01:50:19
Date: Sat, 26 Apr 2025 01:50:19 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=ab08096d-bc28-4942-942e-10897356bdf6

0
354 B

78ms
76ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=ab08096d-bc28-4942-942e-10897356bdf6
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=ab08096d-bc28-4942-942e-10897356bdf6
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:19 GMT

GET
H2

200

sync
odr.mookie1.com/t/v2/ Frame ACBD
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?gdpr=0&gdpr_consent=&profile=342&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11614%26id%3D%24%7BCRITEO_USER_ID%7D
https://x.bidswitch.net/sync?ssp=criteo&custom_data=b4ZHQl9uOW5ySGVxTU5uYkhySHppTUhmNHNzdWl1Rk1wNiUyQlZPb3pYdFFjZjJHcHZ6ZGllT1ZJRFdEbVlTT1R3ZyUyRnROclc0RmhxaHFKUnk1TVFrQzc1cWJ6czFtTm44RiUyRnRQYUxaR...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=ab08096d-bc28-4942-942e-10897356bdf6&ssp=criteo&gdpr=0&gdpr_consent=

43 B
632 B

126ms
60ms

Image
image/gif

35.190.90.30
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=ab08096d-bc28-4942-942e-10897356bdf6&ssp=criteo&gdpr=0&gdpr_consent=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.190.90.30 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 30.90.190.35.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-application-context: application
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-length: 43
content-type: image/gif;charset=UTF-8
server: Apache

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=ab08096d-bc28-4942-942e-10897356bdf6&ssp=criteo&gdpr=0&gdpr_consent=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:19 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame ACBD
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID
https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R37AA1_1275A9BF0_FEEEB3EB&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

78ms
77ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D

Protocol

HTTP/1.1

Server

38.68.201.140 Ashburn, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-428637020; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-428637020; includeSubDomains
Cache-Control: no-cache
Date: Sat, 26 Apr 2025 01:50:20 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:13 GMT
server: nginx

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=280266010643178489

0
354 B

76ms
74ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=280266010643178489
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=280266010643178489
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.45.122; 146.70.45.122; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: bd84fa7e-4312-4384-8c0a-b876b774a26c
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 26 Apr 2025 01:50:19 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://ads.yieldmo.com/pbsync?gdpr=0&gdpr_consent=&is=rise&redirectUri=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11584%26uid%3D%24UID&us_privacy=
https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xcwn9SSXwnSJWFJOhhvc&gdpr=0&gdpr_consent=&us_privacy=

0
354 B

88ms
87ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xcwn9SSXwnSJWFJOhhvc&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xcwn9SSXwnSJWFJOhhvc&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings
https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings&zcc=1&cb=1745632219711
https://ad.turn.com/r/cs?pid=45&id=RX-c7662aee-25f0-4a5e-ab89-312a9e6ddb2d-005&rndcb=2310463102
https://sync.1rx.io/usersync/turn/3939934405842465097?dspret=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-c7662aee-25f0-4a5e-ab89-312a9e6ddb2d-005?redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11599%26id%3DRX-c7662aee-25f0-4a5e-ab89-312a9e6ddb2d-005
https://cs.yellowblue.io/cs?aid=11599&id=RX-c7662aee-25f0-4a5e-ab89-312a9e6ddb2d-005

0
354 B

103ms
102ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11599&id=RX-c7662aee-25f0-4a5e-ab89-312a9e6ddb2d-005
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11599&id=RX-c7662aee-25f0-4a5e-ab89-312a9e6ddb2d-005
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Sat, 26 Apr 2025 01:50:20 GMT
etag: RXc7662aee25f04a5eab89312a9e6ddb2d005
content-type: text/html

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://csync.loopme.me/?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D
https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=bff0dfbd-f4d2-4c35-82f1-ba0ae0c92f99&gdpr_consent=null&gdpr=0

0
354 B

58ms
56ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=bff0dfbd-f4d2-4c35-82f1-ba0ae0c92f99&gdpr_consent=null&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=bff0dfbd-f4d2-4c35-82f1-ba0ae0c92f99&gdpr_consent=null&gdpr=0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
server: _

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=rise&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11574%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=ad8e5e1040

0
354 B

74ms
73ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=ad8e5e1040
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=ad8e5e1040
content-length: 5
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: text/plain; charset=utf-8

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://sync.inmobi.com/oRTB?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=
https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-7-e778ff8d-a774-4b8b-8899-7a77bb9e788a

0
354 B

87ms
84ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-7-e778ff8d-a774-4b8b-8899-7a77bb9e788a
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-7-e778ff8d-a774-4b8b-8899-7a77bb9e788a
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
x-envoy-upstream-service-time: 10
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://us-u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=58ceaaf5-c766-4c17-869a-d76e43401714&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26id%3D
https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=bcf371df-a6ac-4dc7-b81c-0c5defa3e8f6

0
354 B

66ms
57ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=bcf371df-a6ac-4dc7-b81c-0c5defa3e8f6
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=bcf371df-a6ac-4dc7-b81c-0c5defa3e8f6
pragma: no-cache
x-forwarded-for: 146.70.45.122
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://ads.stickyadstv.com/user-matching?gdpr=0&gdpr_consent=&id=3663
https://cs.yellowblue.io/cs?aid=11601&id=5880bb612e2986c39a66666b29f949c&gdpr_consent=&gdpr=0

0
354 B

129ms
127ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=5880bb612e2986c39a66666b29f949c&gdpr_consent=&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache
Location: https://cs.yellowblue.io/cs?aid=11601&id=5880bb612e2986c39a66666b29f949c&gdpr_consent=&gdpr=0
Pragma: no-cache
x-sticky-vk: 1745632219722054-67
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Sat, 26 Apr 2025 01:50:19 GMT
Server: nginx

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://creativecdn.com/cm-notify?pi=rise
https://creativecdn.com/cm-notify?pi=rise&tc=1
https://cs.yellowblue.io/cs?aid=11610&id=J-pTO7w_KjS-r75JLN8WTopoUIpm8VjHEZAdM8yy60Q&pi=rise&tc=1

0
354 B

90ms
89ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11610&id=J-pTO7w_KjS-r75JLN8WTopoUIpm8VjHEZAdM8yy60Q&pi=rise&tc=1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://cs.yellowblue.io/cs?aid=11610&id=J-pTO7w_KjS-r75JLN8WTopoUIpm8VjHEZAdM8yy60Q&pi=rise&tc=1
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT, Sat, 26 Apr 2025 01:50:20 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://contextual.media.net/cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3C...
https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3886338197269814000V10

0
354 B

119ms
119ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3886338197269814000V10
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3886338197269814000V10
timing-allow-origin: *
pragma: no-cache
expires: Sat, 26 Apr 2025 01:50:19 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
content-length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: text/html
server: Apache

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11580%26puid%3D33XUSERID33X
https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=213085436426222

0
354 B

76ms
75ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=213085436426222
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=213085436426222
pragma: no-cache
referrer-policy: unsafe-url
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
server: 33XP016

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://sync.go.sonobi.com/us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=9e8a09b2-80f5-40da-a295-d4e3205e9e87

0
354 B

84ms
84ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=9e8a09b2-80f5-40da-a295-d4e3205e9e87
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-cache, no-store, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=9e8a09b2-80f5-40da-a295-d4e3205e9e87
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Sat, 26 Apr 2025 01:50:20 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-13
x-xss-protection: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://visitor-risecode.omnitagjs.com/visitor/bsync?name=risecode&uid=40a3c28f9ffc73ee86df2bac2d2bb390&url=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26fwrd%3D1%26aid%3D11609%26id%3D%5BBUYER_I...
https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=70ac8aeff1362c1c31d2486cd4d232c6

0
354 B

85ms
83ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=70ac8aeff1362c1c31d2486cd4d232c6
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=70ac8aeff1362c1c31d2486cd4d232c6
x-kong-request-id: d59ff6408a38187e177ffc74438e262d
via: kong/3.6.1
x-kong-upstream-latency: 2
x-kong-proxy-latency: 0
content-length: 0
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: text/html; charset=UTF-8
server: fasthttp

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://bh.contextweb.com/bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=ymwrUax7ZRnz&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0

0
354 B

80ms
79ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=ymwrUax7ZRnz&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=ymwrUax7ZRnz&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-cc58c7bc8-9tv7t
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-US
server: Jetty(12.0.17)

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=77&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11600&id=2104995757754691308&gdpr=0&gdpr_consent=

0
354 B

57ms
56ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11600&id=2104995757754691308&gdpr=0&gdpr_consent=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

date: Sat, 26 Apr 2025 01:50:19 GMT
location: https://cs.yellowblue.io/cs?aid=11600&id=2104995757754691308&gdpr=0&gdpr_consent=
content-length: 0

GET cookie
cm.adform.net/ Frame ACBD 0
0

GET
H2

200

cs
cs.yellowblue.io/ Frame ACBD
Redirect Chain

https://match.sharethrough.com/universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422
https://cs.yellowblue.io/cs?aid=11587&uid=a44abfc1-2ad3-4d08-a83b-43f804948798&gdpr=0

0
354 B

62ms
62ms

Image
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=a44abfc1-2ad3-4d08-a83b-43f804948798&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Sat, 26 Apr 2025 01:50:20 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cs.yellowblue.io/cs?aid=11587&uid=a44abfc1-2ad3-4d08-a83b-43f804948798&gdpr=0
content-length: 0

GET
H3 200 setuid
prebid.intergient.com/ Frame ACBD 0
1 KB 74ms
70ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rise&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=utR6uV29C
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632219&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=fxQCz6HPSCMDOoiYTDaRtKpIN8d%2BQhpaBC8c7UnvFCY%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632219&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=fxQCz6HPSCMDOoiYTDaRtKpIN8d%2BQhpaBC8c7UnvFCY%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 93626dbbcd3c347f-MIA
server: cloudflare

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame F2D6
Redirect Chain

https://ssp.disqus.com/redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716
https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119

0
354 B

61ms
60ms

Document
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Sat, 26 Apr 2025 01:50:19 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0

Redirect headers

cache-control: no-store
content-length: 0
expires: 0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
pragma: no-cache

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame BF26
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage
https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

269 B
379 B

60ms
59ms

Document
text/html

23.220.141.176
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.220.141.176 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-141-176.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 26 Apr 2025 01:50:19 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
location: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 95CB 2 KB
1003 B 303ms
142ms Document
text/html 51.222.39.185
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.185 , Canada, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ip185.ip-51-222-39.net

Software

Resource Hash

d6b9ac8ccff69f2de32254b96a2bb180535f809c2d8059d40be5844a8cbad026

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 870
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame F088
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KjuuAQZHrkJjU4DHRiCEDkc-

0
354 B

88ms
87ms

Document
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KjuuAQZHrkJjU4DHRiCEDkc-
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Sat, 26 Apr 2025 01:50:19 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KjuuAQZHrkJjU4DHRiCEDkc-
vary: Accept-Encoding

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 396C 725 B
799 B 207ms
109ms Script
text/javascript 35.201.101.243
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=201&ttfrms=27&brid=96&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTau%40%3A%3DTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JD&srcurlD=0&aUrlD=0&ssl=https:&dfs=19&ddur=292&uid=1745632219481608&jsCallback=dvCallback_1745632219481489&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7690&tgjsver=7690&lvvn=28&m1=96&refD=2&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&fwc=0&fcl=1392&flt=0&fec=127&fcifrms=27&brh=2&dvp_epl=174&noc=48&nav_pltfrm=Linux%20x86_64&ctx=2198896&cmp=DV184445&sid=conversant&plc=DV-CNVR-IQM_Brand_View&btreg=[CV_UNIQUE_ID]&adsrv=8&advid=3819603&turl=https://paint.toys/oil&c1=2621&c2=273&c3=[AD-HOC_TEST_VALUE]&c4=1&auip=[BID_IP_ADDRESS]&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=230&auevent=1119080698636045545&aucmp=40048300&ausite=561707207&auxch=[EXCHANGE_ID]&audvc=2&pltfrm=9252682&autt=1&mib=0&dvp_auip=[BID_IP_ADDRESS]&DVPX_PP_AUCTION_UA=%5BURL-ENCODED_BID_USER-AGENT%5D&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=1600806058547.3223&ee_dp_sukv=1600806058547.3223&dvp_tukv=1684141442145.3638&ee_dp_tukv=1684141442145.3638&dvp_tuid=1131284854490&jurtd=3768430789
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements7690.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.101.243 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 243.101.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 773f2a99db21d34c970639454cf25fdad25cab5cc9f60fe0923c9d7a01454124

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
Expires: 04/25/2025 01:50:19
Date: Sat, 26 Apr 2025 01:50:19 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D440
Redirect Chain

https://x.bidswitch.net/sync?ssp=ozone&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=ozone&bsw_param=ab08096d-bc28-4942-942e-10897356bdf6&google_hm=YWIwODA5NmQtYmMyOC00OTQyLTk0MmUtMTA4OTczNTZiZGY2&g...
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEACjqY2R5rA4r7DZ-4wmMNg&google_cver=1&ssp=ozone&bsw_param=ab08096d-bc28-4942-942e-10897356bdf6&gdpr_consent=&gdpr=0
https://elb.the-ozone-project.com/setuid?bidder=bidswitch&gdpr=0&gdpr_consent=&us_privacy=&uid=ab08096d-bc28-4942-942e-10897356bdf6

0
605 B

78ms
76ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=bidswitch&gdpr=0&gdpr_consent=&us_privacy=&uid=ab08096d-bc28-4942-942e-10897356bdf6
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93626dbdaceca658-MIA
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //elb.the-ozone-project.com/setuid?bidder=bidswitch&gdpr=0&gdpr_consent=&us_privacy=&uid=ab08096d-bc28-4942-942e-10897356bdf6
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 01:50:19 GMT

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame BF26 44 KB
0 2ms
2ms Script
text/html 23.220.141.176
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.220.141.176 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-141-176.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: cf93b1fadcd08acad574d6b9388a3a26cd9ce1e0ffe32b71a983f58b34ddb6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

Response headers

cache-control: max-age=56765
content-encoding: gzip
expires: Sat, 26 Apr 2025 17:36:22 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Sat, 26 Apr 2025 01:50:17 GMT
last-modified: Fri, 25 Apr 2025 17:36:20 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9E70 42 B
65 B 62ms
61ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuVqGShQWS-CW-oC5RGoFEU0u4zcrZS4DVhouv4dB9QKqvmJ2qtdL1idZoUkhpe5G4jZbXdo7Di5U6xYpODLdHSKUy2h3HbnH105RenL9xQ_Qiu0i6PLk0RNu3c6yERoRv1uleVE6u_dDFAajM-ke0nNYm6voBaq2aPtCn95Yw2VQXklck&sig=Cg0ArKJSzKdgB9QU9LFIEAE&id=lidar2&mcvt=1023&p=313,20,913,180&tm=1159.1999998092651&tu=136.39999961853027&mtos=1023,1023,1023,1023,1023&tos=1023,0,0,0,0&v=20250423&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=2747221344&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4156501800&rst=1745632218328&rpt=277&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Apr 2025 01:50:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B2D5 2 KB
2 KB 55ms
55ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=6967768&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c860d3f745a3e8d03a22cb21a7ab49f522507ac8934857fc817cd8db8ff15bbe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 1853
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:18 GMT
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 0C7C
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=24b8adbb-13be-4af6-8ba6-0313143479bb&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=58D4D86C-1A37-49F0-88F8-7CE261999DE3

42 B
493 B

56ms
56ms

Document
image/gif

18.210.62.131
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=58D4D86C-1A37-49F0-88F8-7CE261999DE3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.62.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-62-131.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Sat, 26 Apr 2025 01:50:20 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Sat, 26 Apr 2025 01:50:19 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=58D4D86C-1A37-49F0-88F8-7CE261999DE3
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET

pubmaticmatch
match.adsby.bidtheatre.com/ Frame 1D2B
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=lUvKU5ARnlKOFcsBwEPXVJsQmAiOS8hSwUrvvTV5
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

0
0

GET sync
t.adx.opera.com/pub/ Frame DD7B 0
0

GET

cookie
sync.cootlogix.com/api/ Frame CA97
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=cf8eeac1-2240-11f0-9ed4-e4922b76b7d4
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=&gdpr_consent=&us_privacy=

0
0

GET

pubmaticmatch
match.adsby.bidtheatre.com/ Frame 2CF9
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:e72c680c-3bdc-4500-a52c-36c4a455dcb3&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

0
0

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame CBDB
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=58D4D86C-1A37-49F0-88F8-7CE261999DE3

0
351 B

76ms
74ms

Document
application/javascript

54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=58D4D86C-1A37-49F0-88F8-7CE261999DE3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://ads.pubmatic.com/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Sat, 26 Apr 2025 01:50:20 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0

Redirect headers

content-length: 115
content-type: text/html; charset=utf-8
date: Sat, 26 Apr 2025 01:50:20 GMT
location: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=58D4D86C-1A37-49F0-88F8-7CE261999DE3
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame 6719 0
181 B 582ms
131ms Document
text/html 159.89.252.170
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.252.170 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Sat, 26 Apr 2025 01:50:20 GMT

GET

csync
sync.adtelligent.com/ Frame 4A18
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=J-pTO7w_KjS-r75JLN8WTopoUIpm8VjHEZAdM8yy60Q&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&g...
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=58D4D86C-1A37-49F0-88F8-7CE261999DE3&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D

0
0

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 618C 0
0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 674E 0
1 KB 70ms
69ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=58D4D86C-1A37-49F0-88F8-7CE261999DE3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93626dbe0cf5347f-MIA
content-encoding: br
content-type: text/html
date: Sat, 26 Apr 2025 01:50:19 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745632219&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=fxQCz6HPSCMDOoiYTDaRtKpIN8d%2BQhpaBC8c7UnvFCY%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745632219&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=fxQCz6HPSCMDOoiYTDaRtKpIN8d%2BQhpaBC8c7UnvFCY%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame B2D5 0
0

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame B2D5
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R37AA1_1275A9BF0_FEEEB4ED&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

57ms
56ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.68.201.140 Ashburn, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-428637020; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-428637020; includeSubDomains
Cache-Control: no-cache
Date: Sat, 26 Apr 2025 01:50:20 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 26 Apr 2025 01:50:18 GMT
server: nginx

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame D440
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-ozone&gdpr=0&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177&gdpr=0

0
781 B

95ms
94ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177&gdpr=0
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93626dbe8e07a658-MIA
expires: 0
content-length: 0
date: Sat, 26 Apr 2025 01:50:19 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=M9XKCLXK-K-6177&gdpr=0
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f69a50991384d09413b97a37bb74928b
content-length: 0
Content-Type: text/html

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 56ms
50ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=9998&edtl=4.13.0%2C1&cb=598264&vtime=567
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 56ms
51ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=3200&edtl=C3PO%3A%2F778e28c9f990c3aad1c7a7cb3471ea1c029ea7f123cbebd6362141ab91cf9e2a%2Fe07363fe-dddd-499d-88df-691a2ba5dd93&cb=839690&vtime=567
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 57ms
51ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=10&edtl=&cb=586339&vtime=577
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 84ms
78ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=17&edtl=1&cb=295812&vtime=577
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 57ms
52ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=9103&edtl=4.13.0%2C1&cb=116744&vtime=589
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 57ms
52ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=9409&edtl=-1&cb=905865&vtime=590
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 82ms
78ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=9409&edtl=-1&cb=345126&vtime=590
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 current
iad-usadmm.dotomi.com/event/ad/lifecycle/ Frame 9E70 43 B
228 B 110ms
106ms Image
image/gif 159.127.42.140
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://iad-usadmm.dotomi.com/event/ad/lifecycle/current?rt=1&dtm_server_id=1602&dtmid=712606650934641350&magic=1&utype=0&dvcid=&comId=2621&dtm_user_ip=146.70.45.122&fpc=0&pnid=15900&supplyType=1&trid=1119080698636045545&btcurl=paint.toys&pid=9252682&mwp=AAABlm_Jw4JqKguP7QKS9ufxd7tmpA5ruYtf8g&msgCampId=40048300&tid=750586341&ptid=700079378&assigned_creative_id=750586341&parentMsgId=40048300&ctrl_ad_id=5&icb=0&ms=21&ad_start=1745632218340&ver=4&assigned_creative_id=750586341&etype=9111&edtl=4.13.0%2C1%2CACE&cb=428949&vtime=590
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.127.42.140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad09-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, private, max-age=0, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: *
content-length: 43
date: Sat, 26 Apr 2025 01:50:19 GMT
content-type: image/gif
server: nginx

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 1BE0 2 KB
2 KB 58ms
56ms Document
text/html 54.211.247.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=b5ff3c34-ec31-4103-84ea-de1cd38ea611&linkedin.com=e21ca61d-319f-490f-9a5f-609d758873fa&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745632216105&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.211.247.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-247-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e66ef456be41a7d5ad69b05aa5d9ac34e183f486764a640e39bc05ddc17c2827

Request headers

Referer: https://elb.the-ozone-project.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://elb.the-ozone-project.com/
access-control-expose-headers: X-Reason
content-length: 2002
content-type: text/html
date: Sat, 26 Apr 2025 01:50:20 GMT
server: istio-envoy
x-envoy-upstream-service-time: 3

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
227 B 54ms
54ms Image
text/plain 3.81.174.250
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.174.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS