paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://dhfbg.markisfullofshit.com/bhdvoktpmqhivmyzexclzhyvtfzkhjRbmJVTkdaY3ZuT0FmcHd5b2VBYkEtMjc0MC0yNjc1MDMyOS0wZmNjMDI3MC0zOTcxLW1iUGdZcmpibjhiU09VMnZQVjF1/hzqalmui5taqno0jjtiiy1gt6qpoimv0l/fuqjty/lhxoay0ymn7ov
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 25135
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Wed, 30 Apr 2025 03:46:35 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JT2CVCX5YDC73E106N8XHCT8

Redirect headers

accept-ranges: bytes
age: 25135
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Wed, 30 Apr 2025 03:46:35 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JT2CVCVGM9EXD03Y53GCV6C6

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 237ms
114ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39e7467f104443cdcd611a7ed69212308c518ac689cb2c6d795bb5571b30d1aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 93840d8d4aa74ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 31ms
29ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 14242
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JT2CVCYE5VMX720MGPT7W3NY
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 30ms
28ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 25134
accept-ranges: bytes
content-length: 1161
x-nf-request-id: 01JT2CVCYEJQHBEDZPNVDPP0YM
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 33ms
31ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 14573
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JT2CVCYE1XB6JKC7576QB37R
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 33ms
32ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 14242
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JT2CVCYEXQAQKH6HJWH84T2Z
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 33ms
31ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 14242
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JT2CVCZK8TAC1RYVPMJVV8FV
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 34ms
32ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 14242
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JT2CVCZKJPH34YZMN02678DD
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 2 KB
1 KB 140ms
53ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0331e0c80428104ee2b85ffee6d77e8cbb0d41e05966fb7b65bc42708e0a1f45

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 93840d8d4aaa4ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 366 KB
123 KB 163ms
69ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dbd2e944813a53ad744da3258c13671408a7414dccb742623c7526dbe589c911

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1072:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1072:0"}],}
expires: Wed, 30 Apr 2025 03:46:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1072:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1072:0
content-length: 125246
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 bb95_5380.v2.js Show response
faucetfoot.com/chunks/78750294f43a1e52/ 68 KB
25 KB 247ms
62ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/chunks/78750294f43a1e52/bb95_5380.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

a47c1ac90168cf0dffc9f174f2939b5843584dac98a4cb52f2ac9bace4b01294

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"438c599e3d9cdca7ba703f7cf72c172c113eef78ab17becd77b4da9fa9f0110c"
via: fen-hoothoot-us-east1-spot-s4nj.gce-us-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 148ms
52ms Script
text/javascript 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a0824ae8efb67cdb6e1d22dd0c002ddb4f053f08fdd17af8fea6d459f64cc2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 696 / 20208 / m202504240101 / config-hash: 7875046863786205115
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 03:46:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33893
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 45ms
43ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 6436
cf-ray: 93840d8e2c6f4ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
109 KB 62ms
61ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54s1h1v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103173737~103173739~103200001

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a1aca82cf7f4c8e7198b7f4e24eb1a3ba13dc9df8839030ca7f2a5fabfffeace

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1072:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1072:0"}],}
expires: Wed, 30 Apr 2025 03:46:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1072:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1072:0
content-length: 111396
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 154ms
52ms Fetch
text/plain 2607:f8b0:4004:c08::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54s1h1v9101576445za200&_p=1745984795604&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103173737~103173739~103200001&cid=791481573.1745984796&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745984795&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1176
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 411 B
336 B 37ms
36ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cbab43d2db3b77efdbf5cae66c7f8e202c70b3c136237f4f977bef40d86507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a2f607b2abbb34303d7b9531c1a9ebcc"
age: 6840
cf-ray: 93840d8e7cf84ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.816717f0fefdba312f2f.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
2 KB 36ms
35ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faa04735dd36414ea1be1f8e0ecce4c41f47ccc65c94e754c4073e1f6a59c115

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"cd64d4c5fb9e686de5a9d31f5c6e1020"
age: 6843
cf-ray: 93840d8ead914ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.25cd0c88862d62596ad5.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 462 KB
140 KB 42ms
41ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f0fb98629bdcde55be36d3852ea70d065674c404f1c63380b750816c5050720

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a83125d38dc322a379d22cc11148e4b4"
age: 6842
cf-ray: 93840d8ead934ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:14 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 41ms
40ms Fetch
text/plain 2607:f8b0:4004:c08::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54s1h1v9102396898za200zb9101576445&_p=1745984795604&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103173737~103173739~103200001&cid=791481573.1745984796&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745984796&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1745984795604&tfd=1423
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54s1h1v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103173737~103173739~103200001
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a0824ae8efb67cdb6e1d22dd0c002ddb4f053f08fdd17af8fea6d459f64cc2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 696 / 20208 / m202504240101 / config-hash: 7875046863786205115
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 03:46:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 30 Apr 2025 03:46:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33893
x-xss-protection: 0
server: cafe

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 559 B
467 B 43ms
42ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 6821
cf-ray: 93840d90898e4ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame C101 503 B
427 B 257ms
88ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 6840
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93840d91a86b0f89-EWR
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 03:46:36 GMT
hw-country-code: US
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame FE6C 503 B
0 245ms
245ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 6840
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 93840d91a86b0f89-EWR
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 03:46:36 GMT
hw-country-code: US
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Tue/23/desktop/Chrome/ 585 B
922 B 961ms
318ms XHR
application/json 2600:9000:215f:e400:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Tue/23/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:e400:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: b55ca827d463bd341dee65dd4fa585da06b09298138745ff8a598abc637eea13

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 2656
via: 1.1 0df778cadb5eaa000de4f1d7838b16e0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 585
x-amz-cf-id: qnITMmpN3l9z0EZvXEYhSfZOatqH80wGTnImJop2kmzdLPjKX3cfZg==
date: Wed, 30 Apr 2025 03:02:21 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 148 KB
39 KB 171ms
39ms Script
application/javascript 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 935c577e049e7e6b2390df7546eea11a24b5676962ba8eaaed3aa0060fe83dc9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "9a6a4be7cde4e31ca272bb8115a08ac9"
via: 1.1 google
cf-ray: 93840d918fc8c466-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39596
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/javascript
last-modified: Wed, 30 Apr 2025 03:16:41 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 358 KB
86 KB 545ms
165ms Script
application/javascript 205.251.251.173
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 205.251.251.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-205-251-251-173.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e8038af98d7bb29f3afeaa574476bffe2ff88d6719b5288794c91f138d5a7608

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"9d8e51445fe1950b9a70539c4015f393"
age: 1347
via: 1.1 71b24e89f6f9e648d6cc206b3f6cc3da.cloudfront.net (CloudFront), 1.1 ea419f8269940bd7231c70acd36c430c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: spY872jQPlAiPIAHqCZd6Vgre3l_oVqzjERIdG7ej-0Uc_0vnqET7Q==
date: Wed, 30 Apr 2025 03:24:10 GMT
content-type: application/javascript
last-modified: Mon, 28 Apr 2025 18:20:19 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, YUL62-C2
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
594 B 157ms
49ms Image
image/gif 2606:50c0:8000::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8000::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: fe3f5e275ef83e6fa0430c228c4fc7061fe0d87b
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 4A6B:3FCBAC:98C1DD:BF55DF:67FE3F52
expires: Wed, 30 Apr 2025 03:51:36 GMT
x-cache: HIT
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: image/gif
x-served-by: cache-ewr-kewr1740043-EWR
x-cache-hits: 10
source-age: 165
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1745984796.383248,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 150ms
38ms Script
text/javascript 3.167.69.97
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-97.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 75740
via: 1.1 21478ed02559c3de2f3f6b7052aaf6ca.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 4fudoleMi09-adpMjdpU-O-4ZvMgCXdZaU-OHnBU-DHwADb53MkVxQ==
date: Tue, 29 Apr 2025 06:44:17 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/ 525 KB
166 KB 35ms
34ms Script
text/javascript 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31ca1392635c24394cf31000a4dd0a135c200091eb4e39a3d2eaac0276a4a640

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4367321893275696535
age: 48557
x-content-type-options: nosniff
expires: Wed, 29 Apr 2026 14:17:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 29 Apr 2025 14:17:19 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169522
x-xss-protection: 0
server: cafe

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
482 B 250ms
76ms Image
image/gif 2600:9000:27aa:9200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=ad_300x250_935180
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27aa:9200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 17896
x-cache: Hit from cloudfront
x-amz-cf-id: EQGTdcqEGjRAURaoCGqMVghYatvDv-EPcUYBH1g7AWkvjdHDAFY_mQ==
date: Tue, 29 Apr 2025 22:48:21 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 4b33afd312f1c04710ff706a980f6a00.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: PHL51-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504290101/ 64 KB
23 KB 75ms
73ms Other
text/plain 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504290101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de83d54c3c01768225e8fb034f65dd15098c70db8b2cd23e4708b9f8c08bd43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 9807650885361896136
age: 47718
x-content-type-options: nosniff
expires: Tue, 06 May 2025 14:31:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 29 Apr 2025 14:31:18 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23837
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504290101"

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 199 KB
65 KB 230ms
67ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

449d766de97ecf68e2f2c78f29e4d9339f4a44f9714d310f50e35dd232b2f3ea

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-LDBciW0DtpIc_OxxWy9kbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw0JBiOHnrNtNFIG69eY51KhAbrT3P6gTEhgqXWB2B-P66S6zPgfhD_WXWH0BcJHGFtQmIP1XdYBWqvsEam3aTNRWIe_feZL1x5Cbrro23WA8BcZP2bdYuIBbi4Ziz69gBNoED245eZlLSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTAxMtczMIgvMAAAq0lErw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-LDBciW0DtpIc_OxxWy9kbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame C101 17 KB
7 KB 39ms
39ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 6838
cf-ray: 93840d9278e40f89-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame FE6C 17 KB
0 33ms
33ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 6838
cf-ray: 93840d9278e40f89-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
548 B 227ms
92ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 662925
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 93840d938e5075e1-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 141ms
32ms Image
image/x-icon 142.250.31.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 54875
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 12:32:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Apr 2025 12:32:01 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 226ms
92ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.8588767546365269
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 662925
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 93840d938e5375e1-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET 95099619-6408-4ee0-b5c0-86b50130aef7
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 165ms
71ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 30 Apr 2025 03:46:36 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 180620
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 159ms
38ms XHR
application/json 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 47215
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745879385&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=Js9yCZLunA6Z4vRa49q3p4sfXwu7nwui1MaS2lKbc4o%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Mon, 28 Apr 2025 22:29:46 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745879385&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=Js9yCZLunA6Z4vRa49q3p4sfXwu7nwui1MaS2lKbc4o%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 93840d93991ee640-EWR
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
1 KB 38ms
37ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 6834
cf-ray: 93840d92ee0e4ba5-EWR
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 195ms
40ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: dhfbg.markisfullofshit.com
URL: https://dhfbg.markisfullofshit.com/bhdvoktpmqhivmyzexclzhyvtfzkhjRbmJVTkdaY3ZuT0FmcHd5b2VBYkEtMjc0MC0yNjc1MDMyOS0wZmNjMDI3MC0zOTcxLW1iUGdZcmpibjhiU09VMnZQVjF1/hzqalmui5taqno0jjtiiy1gt6qpoimv0l/fuqjty/lhxoay0ymn7ov
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: b7d6032873dc97a0e9fe8bdc48c86c4f5993874271c6ce60e2ed93a676dc366e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 444 KB
141 KB 207ms
78ms Script
text/javascript 2607:f8b0:4004:c1f::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8175cb0c911b8a6f52bf56e2c7350936bf17b460dec45b70aa87b469fd51b9bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8184156583072042479
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 03:46:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 143605
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 489ms
198ms Fetch
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-84-72-103.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
778 B 234ms
97ms Fetch
application/json 44.216.112.86
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.216.112.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-112-86.compute-1.amazonaws.com
Software: /
Resource Hash: d6d27838f19cfd498e6e9294c14269314736a7d913ce41c55159b108f3f80022

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
684 B 261ms
47ms Fetch
application/javascript 52.201.17.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.17.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-17-141.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: a8c9c21d573ecc9a5daecae2a928317b7c689ec44d850e6f8f98282de5576f63

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 181ms
48ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7ee6cb6d68d7d686784312f4bd783c3cbe92c8adf85969e0c651c7b9f69d48f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 519 B
933 B 213ms
94ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jt2cvdysxt6b0687c7yhhv5b&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6f5eb9eb502758ee2727ff0a3b0e06d3668cc1f4b30d71aed4fef2d650c44787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: c3e45debf6cd1fe9
request-time: 10
access-control-allow-credentials: true
expires: Thu, 01 May 2025 03:46:36 GMT
access-control-allow-origin: https://paint.toys
content-length: 519
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=HGNW9XxHcDNwbEFqV2M0TXE4NzZZWFo4dzhSU2VuN3Y5cEFOOVdWWmw1UXpjQkFEQlVJbFJnMkJsQnRaczdGeU1UVFE4OGlsQjE0VGk1ZHBjSnNUczMyTmJJalZKbmVTSmtVYkpIS3VUaHAxNHZmbWRKa2NkeE9NOUVkV2...

367 B
931 B

164ms
78ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=HGNW9XxHcDNwbEFqV2M0TXE4NzZZWFo4dzhSU2VuN3Y5cEFOOVdWWmw1UXpjQkFEQlVJbFJnMkJsQnRaczdGeU1UVFE4OGlsQjE0VGk1ZHBjSnNUczMyTmJJalZKbmVTSmtVYkpIS3VUaHAxNHZmbWRKa2NkeE9NOUVkV2tHS2Z3WjdSQmgyZFlKaDJFRlJEMzJPenNONHFrWFVTSjJ5MkQ3N0Njdm5xTUs2WlgxcTRKcVJuZFRKSnRXNGhqT1JWUUZkc2lRa3h6VTdxMElDNm5icm50K2llQ0FJR0dSemJlMCsxWWNXTDJybGptZHFFPXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1ff99a80f7d6c29c042f90af4f499f524986c0f01b14d4af5d9907851fefb7cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 566839
expires: 0
access-control-allow-origin: null
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=HGNW9XxHcDNwbEFqV2M0TXE4NzZZWFo4dzhSU2VuN3Y5cEFOOVdWWmw1UXpjQkFEQlVJbFJnMkJsQnRaczdGeU1UVFE4OGlsQjE0VGk1ZHBjSnNUczMyTmJJalZKbmVTSmtVYkpIS3VUaHAxNHZmbWRKa2NkeE9NOUVkV2tHS2Z3WjdSQmgyZFlKaDJFRlJEMzJPenNONHFrWFVTSjJ5MkQ3N0Njdm5xTUs2WlgxcTRKcVJuZFRKSnRXNGhqT1JWUUZkc2lRa3h6VTdxMElDNm5icm50K2llQ0FJR0dSemJlMCsxWWNXTDJybGptZHFFPXw&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 286510
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 30 Apr 2025 03:46:36 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_677a2b77-5437-458b-ad58-d481368cec22_1745984796599
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfNjc3YTJiNzctNTQzNy00NThiLWFkNTgtZDQ4MTM2OGNlYzIyXzE3NDU5ODQ3OTY1OTkQABoNCJy6xsAGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=4d0a95e91b34308309fcc856a5f283a708f437b0c984c60e695d7377777dc03c791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=4d0a95e91b34308309fcc856a5f283a708f437b0c984c60e695d7377777dc03c791426b5417dce21&rand=03127810
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=4d0a95e91b34308309fcc856a5f283a708f437b0c984c60e695d7377777dc03c791426b5417dce21&rand=03127810&expected_cookie=f9ee7860-7987-4e0a-9ef8-0d0e3e810f6c

0
142 B

100ms
99ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=4d0a95e91b34308309fcc856a5f283a708f437b0c984c60e695d7377777dc03c791426b5417dce21&rand=03127810&expected_cookie=f9ee7860-7987-4e0a-9ef8-0d0e3e810f6c
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 6EE1C23041B04136A20A62646D8CD2C3 Ref B: PHL30EDGE0216 Ref C: 2025-04-30T03:46:37Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYz9sOjgmC7RBm0B9JiWw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: /db_sync?pid=10339&puuid=4d0a95e91b34308309fcc856a5f283a708f437b0c984c60e695d7377777dc03c791426b5417dce21&rand=03127810&expected_cookie=f9ee7860-7987-4e0a-9ef8-0d0e3e810f6c
x-msedge-ref: Ref A: 8F8000F8B8544DA1AD3C50FB3AEAFE62 Ref B: PHL30EDGE0216 Ref C: 2025-04-30T03:46:37Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYz9sOiEADgsx7urzHsCg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_677a2b77-5437-458b-ad58-d481368cec22_1745984796599
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_677a2b77-5437-458b-ad58-d481368cec22_1745984796599

1 KB
2 KB

30ms
30ms

Script
application/javascript

18.207.77.150
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_677a2b77-5437-458b-ad58-d481368cec22_1745984796599
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-77-150.compute-1.amazonaws.com
Software: /
Resource Hash: 8a2a05831d26b9cfd47c43f38f1b1e46b97e596ce12a898a68106a50755d7f19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 03:46:36 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_677a2b77-5437-458b-ad58-d481368cec22_1745984796599
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 03:46:36 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
446 B 197ms
83ms XHR
application/json 44.198.22.46
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.198.22.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-198-22-46.compute-1.amazonaws.com
Software: /
Resource Hash: de4daa0c8bc268f209d59f3ed14eb11ba61121a06dbd9bdc657296a3c472ad3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json;charset=utf-8

POST
H3 200 2cbc14b147c8d6753c10a5ab_88010fae9 Show response
faucetfoot.com/create/2f74333cd/ 295 B
319 B 218ms
134ms Fetch
application/json 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/create/2f74333cd/2cbc14b147c8d6753c10a5ab_88010fae9

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/chunks/78750294f43a1e52/bb95_5380.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

4517d3a60f68d5a0c8729d5c2665a1ab817b1a956c76b19ffa96be470b5c1ac7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-spot-s4nj.gce-us-east1, 1.1 google
expires: Wed, 30 Apr 2025 03:46:35 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 AGSKWxV215QQ4c0J9WiK7XyLT-Wv6FMdp5KscV4QGkmsvIwgAmlZhf6CAvWmpYBEYrwvpe0eaUvIWHOFF270cXtLm_HrRMedXJWipDuQt3-B35UblwacZP5Q4byfClVLd52nPDWOzXf3gw== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 64ms
62ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV215QQ4c0J9WiK7XyLT-Wv6FMdp5KscV4QGkmsvIwgAmlZhf6CAvWmpYBEYrwvpe0eaUvIWHOFF270cXtLm_HrRMedXJWipDuQt3-B35UblwacZP5Q4byfClVLd52nPDWOzXf3gw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1OTg0Nzk2LDgxMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJKaWNWU0RIaTJoVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJkaGZiZy5tYXJraXNmdWxsb2ZzaGl0LmNvbSJdLFsyNSwiW1s5NTM0MDI1Miw5NTM0MDI1NF1dIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.JicVSDHi2hU.es5.O/d=1/rs=AJlcJMwq3Q97UOg5poK2v0pfLNMQLWuccQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

51a754f74691393bc02378a8e4ab26240389ed3b4684b4797b305c5f5d459bab

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qEUfDZ9AYwRKkB39ZQD0Fg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxk_Zt1i4gFuLhmLPr2AE2gRNrNkxnVtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDEy1zMwiC8wAACW-j8u"
content-security-policy: script-src 'report-sample' 'nonce-qEUfDZ9AYwRKkB39ZQD0Fg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 019B 101 KB
28 KB 106ms
35ms Document
text/html 2607:f8b0:4004:c21::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38f00721657fd6de7b95747418618530426233d20866cee0737fabaef1ba2876

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1585
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28962
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 03:20:11 GMT
expires: Wed, 30 Apr 2025 04:10:11 GMT
last-modified: Mon, 28 Apr 2025 19:43:10 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 730ms
162ms Script
application/javascript 2600:9000:269f:9200:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:269f:9200:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 1319
x-cache: Hit from cloudfront
x-amz-cf-id: sIhAQpbCX2yIwjxtdQbHNu3_NPraDK0NjJQjHMVUacDkv0mbnfq_Xg==
date: Wed, 30 Apr 2025 03:24:39 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 7ea5749a224369d9af20b6d6ce7dbd92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: YUL62-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 150ms
39ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 980414
x-goog-stored-content-encoding: gzip
expires: Sat, 18 Apr 2026 19:26:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Fri, 18 Apr 2025 19:26:22 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwoPaAQXeFpWmMUUGzN2UOdWiqkz4kw_XtEXDDJ7ekh2Ee6MXuG86p4oePDs4APmaLDSxbZoZTI
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 235ms
121ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 6426468542502e2f01b03f2b778441b2

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 146ms
38ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 166192
cf-ray: 93840d94ee9741fe-EWR
expires: Sat, 03 May 2025 03:46:36 GMT
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 145ms
39ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Thu, 01 May 2025 03:46:36 GMT
access-control-allow-origin: *
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 224ms
72ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 238ms
65ms XHR
application/json 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MkFFV2U4UU5pa28zYkRGM3BhNmdBN20wX0ZpZ0NNYm1UYUFRZWhyZzl6Sm8&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MkFFV2U4UU5pa28zYkRGM3BhNmdBN20wX0ZpZ0NNYm1UYUFRZWhyZzl6Sm8&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEDOf3yBDSnxGXvmos74FdNg&google_cver=1

70 B
440 B

31ms
30ms

Image
image/gif

18.207.77.150
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEDOf3yBDSnxGXvmos74FdNg&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-77-150.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 03:46:37 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEDOf3yBDSnxGXvmos74FdNg&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Wed, 30 Apr 2025 03:46:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=91452127-6d77-454d-9678-41206a260217&bid=1e2n4ou

70 B
440 B

31ms
31ms

Image
image/gif

18.207.77.150
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=91452127-6d77-454d-9678-41206a260217&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-77-150.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 03:46:37 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=91452127-6d77-454d-9678-41206a260217&bid=1e2n4ou
content-length: 191
date: Wed, 30 Apr 2025 03:46:37 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-Y9dv5cBE2pXL50poTiKJXs1_kqjX6i_iIJg-~A&gdpr=0

70 B
440 B

36ms
34ms

Image
image/gif

18.207.77.150
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-Y9dv5cBE2pXL50poTiKJXs1_kqjX6i_iIJg-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-77-150.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 03:46:37 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-Y9dv5cBE2pXL50poTiKJXs1_kqjX6i_iIJg-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=7647630820351314257&newuser=1&referrer_pid=m51mh00

70 B
440 B

32ms
31ms

Image
image/gif

18.207.77.150
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=7647630820351314257&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-77-150.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 03:46:38 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=7647630820351314257&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 03:46:39 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=7646926639373327599&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

30ms
29ms

Image
image/gif

18.207.77.150
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=7646926639373327599&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-77-150.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 03:46:37 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=7646926639373327599&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: e34d857d-5189-4c83-9676-280756f6b3f1
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:37 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3 200 AGSKWxV5JBkW5zAkK1-QTkKGLmGquUBKMHpXS14RgzMQlgYoyYU7S20jqU37GANg6EnNOkcxxHGcOWsDVV-6zUaTv4GEe71XoWzEaLbfefVi2xud1FAuLGXvMHdcn-AK78LSz6wrY4ThQw== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 71ms
71ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV5JBkW5zAkK1-QTkKGLmGquUBKMHpXS14RgzMQlgYoyYU7S20jqU37GANg6EnNOkcxxHGcOWsDVV-6zUaTv4GEe71XoWzEaLbfefVi2xud1FAuLGXvMHdcn-AK78LSz6wrY4ThQw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1OTg0Nzk2LDg5NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiSmljVlNESGkyaFUiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiZGhmYmcubWFya2lzZnVsbG9mc2hpdC5jb20iXSxbMjUsIltbOTUzNDAyNTIsOTUzNDAyNTRdXSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d8fb7ec79f8e7ac42f96f65510a4219c62a90ce4f82d43b69119661ff1b61ef7

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-1UWz0_LGSMOB8_h2eYq_7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw0ZBiOHHrNtMFIG69eY51KhAbrT3P6gTEhgqXWB2B-P66S6zPgfhD_WXWH0BcJHGFtQmIP1XdYBWqvsEam3aTNRWIe_feZL1x5Cbrro23WA8BcZP2bdYuIBbi4Ziz69gBNoEJu34eYFbSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTAxMtczMIgvMAAAqoBEpw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-1UWz0_LGSMOB8_h2eYq_7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 264ms
64ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 30 Apr 2025 03:46:36 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 227467
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame CC24 16 KB
6 KB 131ms
47ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 03:46:36 GMT
server: Kestrel
server-processing-duration-in-ticks: 309673
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 660ms
308ms XHR
application/javascript 205.251.251.173
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 205.251.251.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-205-251-251-173.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 54226
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: inoLcSGF7jyz-VOS4oWfUYZbQhGHSsvO_JQfdVj0qaJXRkWSiASGWA==
date: Tue, 29 Apr 2025 12:42:52 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 9b4f2014232c90b3056e1fb1e00215fc.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: YUL62-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 854ms
303ms Script
application/javascript 54.192.51.46
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-46.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 2405
via: 1.1 612d3e065148a94cbbe94139733f662e.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: F74kvCdc5V82uNuxifOv-otnG9GEok-RJn4IiKEwF7CHOBY-MzMqxA==
date: Wed, 30 Apr 2025 03:06:32 GMT
content-type: application/javascript
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 165ms
165ms XHR
application/json 205.251.251.173
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 205.251.251.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-205-251-251-173.yul62.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 12690
access-control-allow-credentials: true
via: 1.1 ea419f8269940bd7231c70acd36c430c.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: ZXFsAz7bwnKwRmZf-AGMjeRe8rnogE39S0P34wCIT4_Z5i5pRq4yqg==
date: Wed, 30 Apr 2025 00:15:07 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: YUL62-C2
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
375 B 2277ms
463ms Fetch
application/json 3.161.214.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&pid=JGQ3Shi1z4Gk3&cb=0&ws=1600x1200&v=25.424.1149&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=c6826eed-6613-4c98-ad59-07cdc194d49e&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D&vm=%7B%22vendors%22%3A%7B%22liveintent%22%3A%7B%22data%22%3A%7B%22default%22%3A%7B%22user%22%3A%7B%22ext%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22liveintent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2214-MNnwfLomvNAKAY2kpaLz2%2BJ0i%2FjCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh%2BM13v3jzHPYNzWRYhi%2Fs41FwfhpIafXTHg%3D%3D%22%2C%22atype%22%3A3%7D%5D%7D%2C%7B%22source%22%3A%22bidswitch.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2294ba8038-cb95-4b3b-b5ce-2fe6827f3a8d%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22openx.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2266b34471-1074-4fa0-b9ba-39c4f774724e%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22rubiconproject.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22M99RJE97-17-9TYH%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22media.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%223811953486957097000V10%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22pubmatic.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228BC711CF-EB2D-43C7-94CE-EB501467682B%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22liveintent.indexexchange.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ZvOHltHM7yEAAF.vAB2wegAA%26049%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22liveintent.triplelift.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%222735044350763865128379%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22sharethrough.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%224d1e1e76-340a-43c5-88c9-586abfa68e10%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%2C%7B%22source%22%3A%22liveintent.sonobi.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22de4bfa41-9b5d-4eff-9d43-4fa440f447b0%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%5D%7D%7D%7D%7D%7D%7D%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.214.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-214-59.yul62.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 83a743ed393a5cd20768ea48e9372bca.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: bzOBNA85FhAypzKF4t2zYomkIw-BhHRU3I-bMcvV6imo2_33DPTjTA==
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: YUL62-P1
server: Server

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 179ms
44ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
704 B 103ms
38ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 109263281b9baee56f9542801e290e170c5951e94eac7c8bc0f04e898c21b921

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 103ms
38ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 49ms
29ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 31ms
28ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 415ms
132ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

0968e28262a3bfe5123240b4a787638dc1317d88c5a62f9876da1fb172a5870e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1745984797136&did=did-0046&se=e30&duid=8e413bd09c43--01jt2cvdysxt6b0687c7yhhv5b&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdhfbg.mark...
https://rp4.liadm.com/j?dtstmp=1745984797136&did=did-0046&se=e30&duid=8e413bd09c43--01jt2cvdysxt6b0687c7yhhv5b&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdhfbg.mar...

13 B
370 B

213ms
44ms

Fetch
application/json

44.215.200.198
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1745984797136&did=did-0046&se=e30&duid=8e413bd09c43--01jt2cvdysxt6b0687c7yhhv5b&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMwMzY6OjM2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 44.215.200.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-215-200-198.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 209043af-ae8f-4730-aed2-14f4dc39bdcf
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1745984797136&did=did-0046&se=e30&duid=8e413bd09c43--01jt2cvdysxt6b0687c7yhhv5b&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMwMzY6OjM2
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 2ABD 2 KB
1 KB 198ms
59ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=131010
content-encoding: gzip
content-length: 859
content-type: text/html
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: Thu, 01 May 2025 16:10:07 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 25A6 1 KB
2 KB 147ms
27ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 974
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 03:30:23 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwqrL0WfXqB2uY4bsURQHVthRgHeUHVF7mYODg5-3h_29JloDuQBETW5GuPpJrXNiyAiwmIGwvGUwVhweQ

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
960 B 207ms
47ms Fetch
application/json 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://prebid.intergient.com/cookie_sync

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

303d748de68ff6936bf69dc70ebcf058e38da7d0d8d545b0fc73fb62f82d2a04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93840d978fe541db-EWR
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 75 KB
33 KB 658ms
497ms Fetch
application/json 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://prebid.intergient.com/openrtb2/auction

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75f473484cbbe6a04efbd932e6a67eaea719f3fbcec73b4f9d4a591c8d4e2c96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Origin
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 93840d978fe941db-EWR
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
769 B 205ms
78ms Fetch
application/json 3.218.122.15
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.218.122.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-122-15.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 695 B
1 KB 232ms
117ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ASXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE%2BjA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi%2BumoCvnoofCaZqUrz%2BV%2F9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5%2FaBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH%2BnD7%2BCKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy%2BwNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT%2Bzy%2BeBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg%2FDee%2FGStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4%2FRJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd%2BjaH6P2kaicD687Cd9iV199ubulUc%2B%2BRU19IbSIkNxDhQxqoMHqTQh%2FblRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe%2BuwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF%2FQg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM%2Bq%2Fga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv%2BkjKtlE5NN%2Fr%2FuNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z%2BRSreoRsIt9atVu3lGUpxhBagAbYQjkKJed%2FxCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ%2BM74QO%2BueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw%2FmBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu%2Bcq7tc%2BvVsrgrjvaXsRud26ChB81gQlHTebgaB3g6%2Fl1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh%2BBDD3niCquFdu%2BBGIjUFio%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=14-MNnwfLomvNAKAY2kpaLz2%2BJ0i%2FjCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh%2BM13v3jzHPYNzWRYhi%2Fs41FwfhpIafXTHg%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=2735044350763865128379%5E3%5E%5E%5E%5E%5E&eid_media.net=3811953486957097000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M99RJE97-17-9TYH%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA%26049%5E3%5E%5E%5E%5E%5E&eid_openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=557340f7-2dda-462f-9f09-ba32bac7f7ed&l_pb_bid_id=68bc7ec0dd9eebe&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=cf7ee050-f7f3-4a42-b97a-64af7ba8b896&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.6671662302219972
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 526c656c961e224c6fe0036b1c74653c921c65febd1432d32a54e55d9bcff79e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 527 B
877 B 221ms
107ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ASXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE%2BjA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi%2BumoCvnoofCaZqUrz%2BV%2F9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5%2FaBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH%2BnD7%2BCKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy%2BwNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT%2Bzy%2BeBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg%2FDee%2FGStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4%2FRJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd%2BjaH6P2kaicD687Cd9iV199ubulUc%2B%2BRU19IbSIkNxDhQxqoMHqTQh%2FblRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe%2BuwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF%2FQg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM%2Bq%2Fga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv%2BkjKtlE5NN%2Fr%2FuNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z%2BRSreoRsIt9atVu3lGUpxhBagAbYQjkKJed%2FxCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ%2BM74QO%2BueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw%2FmBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu%2Bcq7tc%2BvVsrgrjvaXsRud26ChB81gQlHTebgaB3g6%2Fl1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh%2BBDD3niCquFdu%2BBGIjUFio%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=14-MNnwfLomvNAKAY2kpaLz2%2BJ0i%2FjCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh%2BM13v3jzHPYNzWRYhi%2Fs41FwfhpIafXTHg%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=2735044350763865128379%5E3%5E%5E%5E%5E%5E&eid_media.net=3811953486957097000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M99RJE97-17-9TYH%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA%26049%5E3%5E%5E%5E%5E%5E&eid_openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=557340f7-2dda-462f-9f09-ba32bac7f7ed&l_pb_bid_id=6971e88ed8d9114&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=04563fea-685c-4899-9395-e2ce114b3f5e&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.9380818985686431
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 29fa3fe336bf170ec12a37615fa1ec35cbc43caa706f328397aa2bff3c3e660b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 527
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 533 B
1 KB 152ms
39ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ASXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE%2BjA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi%2BumoCvnoofCaZqUrz%2BV%2F9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5%2FaBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH%2BnD7%2BCKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy%2BwNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT%2Bzy%2BeBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg%2FDee%2FGStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4%2FRJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd%2BjaH6P2kaicD687Cd9iV199ubulUc%2B%2BRU19IbSIkNxDhQxqoMHqTQh%2FblRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe%2BuwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF%2FQg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM%2Bq%2Fga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv%2BkjKtlE5NN%2Fr%2FuNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z%2BRSreoRsIt9atVu3lGUpxhBagAbYQjkKJed%2FxCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ%2BM74QO%2BueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw%2FmBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu%2Bcq7tc%2BvVsrgrjvaXsRud26ChB81gQlHTebgaB3g6%2Fl1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh%2BBDD3niCquFdu%2BBGIjUFio%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=14-MNnwfLomvNAKAY2kpaLz2%2BJ0i%2FjCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh%2BM13v3jzHPYNzWRYhi%2Fs41FwfhpIafXTHg%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=2735044350763865128379%5E3%5E%5E%5E%5E%5E&eid_media.net=3811953486957097000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M99RJE97-17-9TYH%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA%26049%5E3%5E%5E%5E%5E%5E&eid_openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=557340f7-2dda-462f-9f09-ba32bac7f7ed&l_pb_bid_id=70a58370d02ab&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=b59eeefb-d43d-4f19-907c-70173b2defb8&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.24759046992311662
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 49504d6d737a6feeb90fa3ba8bb334e28b1795ca8ce1c7e6b780d9d8e413d69c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 533
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
2 KB 229ms
116ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3ASXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE%2BjA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi%2BumoCvnoofCaZqUrz%2BV%2F9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5%2FaBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH%2BnD7%2BCKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy%2BwNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT%2Bzy%2BeBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg%2FDee%2FGStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4%2FRJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd%2BjaH6P2kaicD687Cd9iV199ubulUc%2B%2BRU19IbSIkNxDhQxqoMHqTQh%2FblRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe%2BuwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF%2FQg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM%2Bq%2Fga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv%2BkjKtlE5NN%2Fr%2FuNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z%2BRSreoRsIt9atVu3lGUpxhBagAbYQjkKJed%2FxCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ%2BM74QO%2BueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw%2FmBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu%2Bcq7tc%2BvVsrgrjvaXsRud26ChB81gQlHTebgaB3g6%2Fl1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh%2BBDD3niCquFdu%2BBGIjUFio%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=14-MNnwfLomvNAKAY2kpaLz2%2BJ0i%2FjCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh%2BM13v3jzHPYNzWRYhi%2Fs41FwfhpIafXTHg%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d%5E3%5E%5E%5E%5E%5E&eid_liveintent.triplelift.com=2735044350763865128379%5E3%5E%5E%5E%5E%5E&eid_media.net=3811953486957097000V10%5E3%5E%5E%5E%5E%5E&eid_rubiconproject.com=M99RJE97-17-9TYH%5E3%5E%5E%5E%5E%5E&eid_liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA%26049%5E3%5E%5E%5E%5E%5E&eid_openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e%5E3%5E%5E%5E%5E%5E&eid_pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B%5E3%5E%5E%5E%5E%5E&eid_sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10%5E3%5E%5E%5E%5E%5E&eid_liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=557340f7-2dda-462f-9f09-ba32bac7f7ed&l_pb_bid_id=71086d6fb80df758&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=1f5f0b97-3981-4530-9982-d312463abc2d&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.6719843611417176
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 19100d73564a7f7dc15de6233cbc7b1efd46d084131b68dc6908cd69694b46fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
1016 B 67ms
63ms Fetch
application/json 68.67.181.211
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 2f53d701-715a-40ce-8557-a58d2bdb64b2
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:37 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 64 KB
18 KB 430ms
316ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4721a82cb47a272b28db954f6489a69e7dd74b7169f6de1c1489e8ee55e48dc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 206.66.99.36
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18184
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/plain
vary: Origin

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 25 B
312 B 273ms
121ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a5d676b1c5974059a8536e9e5d8e157a5f75b9a61656f50babe1676815136b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 34 KB
10 KB 426ms
296ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6394a9699098c92ab3b64e0cd4f2a1a90a939d6a237bd648543ecf93d09744dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 93840d97788d4cac-PHL
expires: 0
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
619 B 857ms
285ms Fetch
application/json 54.192.51.76
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-76.yul62.r.cloudfront.net
Software: istio-envoy /
Resource Hash: ab6d7a2efaa4b642ed3af954fc0ea33d926b71816c54402a002782f8aebbaba5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 9b4f2014232c90b3056e1fb1e00215fc.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: S4sLf7WwqGJLqimfxNY4G9WQP0EO3W72WUdgZQcSTG2CUoFCg383yQ==
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: istio-envoy
x-reason: maxmind anonymous
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 83 KB
27 KB 343ms
246ms Fetch
application/json 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=19132917321&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2bf7fe0fb8d60bce7472514d8a19f95ba3f9466c4767fdf459a389d3b409f538

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 265ms
72ms Fetch 3.84.207.50
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.84.207.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 257ms
66ms Fetch 3.84.207.50
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.84.207.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 255ms
64ms Fetch 3.84.207.50
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.84.207.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 253ms
64ms Fetch 3.84.207.50
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.84.207.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 19 KB
10 KB 291ms
180ms Fetch
application/json 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 843e7a7e3c5b5422dde327703921a33fe042a9415f848269fd625da95ffe81c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
server: nginx

GET imp
g2.gumgum.com/hbid/ 0
0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 213ms
39ms Fetch
application/json 34.192.22.117
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745984797236&to=600&aun=pw-160x600_btf&pubcid=fd346f8b-e7f6-4933-8db4-6312cb36b66e&fabrickId=E1%3ASXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33acrossId=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE%2BjA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi%2BumoCvnoofCaZqUrz%2BV%2F9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5%2FaBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH%2BnD7%2BCKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy%2BwNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT%2Bzy%2BeBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg%2FDee%2FGStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4%2FRJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd%2BjaH6P2kaicD687Cd9iV199ubulUc%2B%2BRU19IbSIkNxDhQxqoMHqTQh%2FblRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe%2BuwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF%2FQg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM%2Bq%2Fga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv%2BkjKtlE5NN%2Fr%2FuNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z%2BRSreoRsIt9atVu3lGUpxhBagAbYQjkKJed%2FxCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ%2BM74QO%2BueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw%2FmBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu%2Bcq7tc%2BvVsrgrjvaXsRud26ChB81gQlHTebgaB3g6%2Fl1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh%2BBDD3niCquFdu%2BBGIjUFio&lipb=14-MNnwfLomvNAKAY2kpaLz2%2BJ0i%2FjCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh%2BM13v3jzHPYNzWRYhi%2Fs41FwfhpIafXTHg%3D%3D&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=04563fea-685c-4899-9395-e2ce114b3f5e&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.22.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-22-117.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET imp
g2.gumgum.com/hbid/ 0
0

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 38 B
662 B 193ms
80ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c25b2248ecbc4ec70fd8f50a1c11912857e18d94b6060b23e60bbdb07f02a6b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Np0HQm61oHpnh9JJtlKTXMlqqbycjxozPpLbxIZaG8Wd4YeapBtFxhzj5F0JIcWe37X266llAHitH%2FlN6K03l1JUpH1CozA6iVZ7SCcOzAVhgH1HbRBn1kU%2FUOy6fvKBBUkMxCE"}],"group":"cf-nel","max_age":604800}
cf-ray: 93840d978ab08e3e-EWR
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 38
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 488ms
365ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 03:46:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 450ms
327ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 03:46:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 377ms
254ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 03:46:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 379ms
256ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 03:46:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 184ms
67ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 251ms
124ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 85ecd3d41368832b1f4b32e6e0d3fdc7a6cafa056d0b14633f255d80dc9c1905

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
x-cloud-trace-context: 0261bd55ef73f37e6d1d6af22cdb4bea
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 186ms
52ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: dhfbg.markisfullofshit.com
URL: https://dhfbg.markisfullofshit.com/bhdvoktpmqhivmyzexclzhyvtfzkhjRbmJVTkdaY3ZuT0FmcHd5b2VBYkEtMjc0MC0yNjc1MDMyOS0wZmNjMDI3MC0zOTcxLW1iUGdZcmpibjhiU09VMnZQVjF1/hzqalmui5taqno0jjtiiy1gt6qpoimv0l/fuqjty/lhxoay0ymn7ov
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Wed, 30 Apr 2025 04:01:37 GMT
accept-ranges: bytes
content-length: 17407
date: Wed, 30 Apr 2025 03:46:37 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 33ms
30ms Script
text/javascript 3.167.69.97
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: dhfbg.markisfullofshit.com
URL: https://dhfbg.markisfullofshit.com/bhdvoktpmqhivmyzexclzhyvtfzkhjRbmJVTkdaY3ZuT0FmcHd5b2VBYkEtMjc0MC0yNjc1MDMyOS0wZmNjMDI3MC0zOTcxLW1iUGdZcmpibjhiU09VMnZQVjF1/hzqalmui5taqno0jjtiiy1gt6qpoimv0l/fuqjty/lhxoay0ymn7ov
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-97.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 72800
via: 1.1 21478ed02559c3de2f3f6b7052aaf6ca.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: HfxNRvRhpEfvFGIg1vjodZq1XjjcFYYw1018igR7PrWlGCJHJySkPg==
date: Tue, 29 Apr 2025 07:33:18 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 222ms
47ms Script
text/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&_it=amazon&partner_id=403
Requested by: Host: dhfbg.markisfullofshit.com
URL: https://dhfbg.markisfullofshit.com/bhdvoktpmqhivmyzexclzhyvtfzkhjRbmJVTkdaY3ZuT0FmcHd5b2VBYkEtMjc0MC0yNjc1MDMyOS0wZmNjMDI3MC0zOTcxLW1iUGdZcmpibjhiU09VMnZQVjF1/hzqalmui5taqno0jjtiiy1gt6qpoimv0l/fuqjty/lhxoay0ymn7ov
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 5
x-amz-request-id: 30EKW3CXSWT5N57D
expires: Mon, 05 May 2025 03:46:37 GMT
cf-ray: 93840d982a7f8c84-EWR
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: 4RIrFaaxfD+TDcC6uYxWpX9IaghtYatCwZOUwila/c0bkzhiT5xDAXkdzqEBgOl600iRD9MSwqA=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 185ms
53ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

572ec137575fa4799de7433a3f493bc02089ed14b410ac493262345f36c79be3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: oglTLQb+dO8IVaeRfeLQdQjWjVSDJy4cgWEdfNjNZRYSpwyrR/u8y6wS+JXGGohdjLmrBNHzIfraRNxFr2tzVpkc72YVa1aA
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"a607a260772d524047ddaed6b9b4fbfb"
age: 1595
x-amz-request-id: NNKGVHXQ8PW0XA4Y
cf-ray: 93840d97eeab43a6-EWR
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript;charset=utf-8
last-modified: Mon, 28 Apr 2025 11:21:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 164ms
51ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: dhfbg.markisfullofshit.com
URL: https://dhfbg.markisfullofshit.com/bhdvoktpmqhivmyzexclzhyvtfzkhjRbmJVTkdaY3ZuT0FmcHd5b2VBYkEtMjc0MC0yNjc1MDMyOS0wZmNjMDI3MC0zOTcxLW1iUGdZcmpibjhiU09VMnZQVjF1/hzqalmui5taqno0jjtiiy1gt6qpoimv0l/fuqjty/lhxoay0ymn7ov
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Wed, 30 Apr 2025 04:01:37 GMT
accept-ranges: bytes
content-length: 5252
date: Wed, 30 Apr 2025 03:46:37 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/ Frame CC24
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1
https://mug.criteo.com/sid?cpp=hij5O3wrR2VYTGszbzE2eHdrUmk5QjNFYnFRaXEya0Z3bWV2cWQraGJCdWpIV3FsNnF2T1M4TzdicG01UlVwSVhLa3FjZDJZalNocDVhYWNDdCtCUCt0Z05nQmFIUzU1eUgrcGZHL1V5VGJyTlJFakMyNm5jb1ZJQXVmZ3...

444 B
1003 B

139ms
50ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=hij5O3wrR2VYTGszbzE2eHdrUmk5QjNFYnFRaXEya0Z3bWV2cWQraGJCdWpIV3FsNnF2T1M4TzdicG01UlVwSVhLa3FjZDJZalNocDVhYWNDdCtCUCt0Z05nQmFIUzU1eUgrcGZHL1V5VGJyTlJFakMyNm5jb1ZJQXVmZ3FwdzVoUk5ndDR4ZEh1VktwK1ozdTl0OGhRMkh2WExyL200M2pEUlVPbElQMEZvSzVGM2FHWGVhUHBVSUtqSDlaT0JoSEdqMDFYRXVuT0E5Z2RvRWovM3ExRjF0a3NmU09SN0RnaHRJZXVlaTQ2cjd6NVU0cVFoazB2cVJOY2VmbXU3VTM3b0xxWC9xeTY3dlRoWjNDLzREb2xiMElUQWZKU0UraURpQTcwcXRxYXN0emtlcz18&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1bc29b822ef9e65614f151ae75444422d737b55904c1d6f9117af68e72aac55c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1036809
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=hij5O3wrR2VYTGszbzE2eHdrUmk5QjNFYnFRaXEya0Z3bWV2cWQraGJCdWpIV3FsNnF2T1M4TzdicG01UlVwSVhLa3FjZDJZalNocDVhYWNDdCtCUCt0Z05nQmFIUzU1eUgrcGZHL1V5VGJyTlJFakMyNm5jb1ZJQXVmZ3FwdzVoUk5ndDR4ZEh1VktwK1ozdTl0OGhRMkh2WExyL200M2pEUlVPbElQMEZvSzVGM2FHWGVhUHBVSUtqSDlaT0JoSEdqMDFYRXVuT0E5Z2RvRWovM3ExRjF0a3NmU09SN0RnaHRJZXVlaTQ2cjd6NVU0cVFoazB2cVJOY2VmbXU3VTM3b0xxWC9xeTY3dlRoWjNDLzREb2xiMElUQWZKU0UraURpQTcwcXRxYXN0emtlcz18&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 249406
expires: 0
content-length: 0
date: Wed, 30 Apr 2025 03:46:36 GMT
server: Kestrel

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 30ms
30ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=99a263f2-cab6-460e-8f07-77441ef654f7&ccsid=de12775a-b92f-42c2-a225-28d41a964ff7
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 14 KB
4 KB 32ms
31ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: eaa7e3d32d237bf9271ddb57b4068ec273bea7ce8efcf3b3eb36f3b6b5b31206

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 45B8 20 KB
7 KB 38ms
37ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=29753
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: Wed, 30 Apr 2025 12:02:30 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 106ms
30ms Image
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=0f952125-61f3-46bf-a173-4d740e076527&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=dhfbg.markisfullofshit.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=3bb8ab59-005e-42cc-bdd5-e025cdccd15e&ccuid=99a263f2-cab6-460e-8f07-77441ef654f7&sid=de12775a-b92f-42c2-a225-28d41a964ff7&nct=1745984797000&r=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&ns=true&lang=en-US&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&devicefp=206.66.99.36%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=fa27525d-20c2-4f2f-991a-b8b794b52dbc&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Wed, 30 Apr 2025 03:46:37 GMT
content-length: 0

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7646926639373327599

86 B
481 B

58ms
58ms

Image
image/png

2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7646926639373327599

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93840d9888a441db-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: image/png
vary: Origin
server: cloudflare
priority: u=3,i

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7646926639373327599
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: c90162e9-afab-442b-bace-92064cce8d10
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:37 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 96ms
93ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Wed, 30 Apr 2025 04:01:37 GMT
accept-ranges: bytes
content-length: 17042
date: Wed, 30 Apr 2025 03:46:37 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 45B8 2 KB
3 KB 146ms
38ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=8878512&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 002a1030b539cdf6f56c0ddaa9ffe2a146fe0a9fdca2dbe399c759dd1f613977

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 852 B
1 KB 216ms
214ms Fetch
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

9ab55d1bfbad012a39783a386ee16801c63584f1e063a6748641578e5463f780

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: Origin

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame D2F8
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%2...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_conse...

2 KB
899 B

51ms
46ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8fff6b2c3402f1b3b769767487bdf21032a924a30e3bc5d3b4d70ab28b6cf7d

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93840d9abe3741bb-EWR
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qGCIm91Zv8EMVUNNns7Mb7u0WcCaauORwPtJP6YLTGy89KUuHw9M0KxW1tYZaEphBzVVtdqIk8KtmDQZ8wx9KdGsuQRrZ1AybzSEGnGEC%2B8ZlBm%2BwrIbioiBlI77tUZWeO656uF6nSjdxA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 93840d9a3dec41bb-EWR
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WyCRV7qD0dapfVTqtAPVTGDUna%2F4GgDmPNNBnNUe8Oo914Q6YgDclXOef%2BALjnNa7Ubx%2FzJSDJVYoOpdbstNJOgPFGfFb%2FSw4Stz3uyKi632%2Bajsb45WY0SK9I7Lmc9vdQ%2BOVPMEaA4vsw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 257ms
71ms XHR
application/json 2606:ae80:1451:19::1460
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1451:19::1460 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Wed, 30 Apr 2025 04:16:37 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
vary: origin
server: nginx

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame B01E
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=

35 B
591 B

81ms
81ms

Document
image/gif

185.167.164.38
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Wed, 30 Apr 2025 03:46:38 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame DED3
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

46ms
46ms

Document
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 30 Apr 2025 03:46:37 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: WY52A4A8VJR2N4R6GAKT

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Wed, 30 Apr 2025 03:46:37 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: W9MJNGB3Z53T7RATCZCC

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F276
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7646926639373327599&gdpr=0&gdpr_consent=

42 B
449 B

46ms
40ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7646926639373327599&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 29 Apr 2025 21:26:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 2933dc78-719a-42b0-b3d1-0ffa0574d6b9
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7646926639373327599&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 8401 0
542 B 114ms
46ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93840d9a7c23a67e-EWR
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: 0
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 45B8
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=45dbffe5-514f-428f-98ff-67b8707d39e0

42 B
321 B

71ms
57ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=45dbffe5-514f-428f-98ff-67b8707d39e0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=45dbffe5-514f-428f-98ff-67b8707d39e0
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 45B8
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=91452127-6d77-454d-9678-41206a260217&icm&gdpr=0&gdpr_consent=&cver
https://spl.zeotap.com/?zdid=1332&zcluid=cc7b261466c376e2
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3826f046-3e90-42df-6f27-2fde4385a520&reqId=10a0694a-4d74-40b7-593c-bbd4c19bd38b&zclui...
https://mwzeom.zeotap.com/mw?google_gid=CAESEGuBNgwyjUbu3VGOQU-F0dI&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3826f046-3e90-42df-6f27-2fde4385a520&reqId=10a0694a-4d74-40b7-593c-bbd...

95 B
165 B

158ms
108ms

Image
image/png

2606:4700:10::6816:3362
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=CAESEGuBNgwyjUbu3VGOQU-F0dI&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3826f046-3e90-42df-6f27-2fde4385a520&reqId=10a0694a-4d74-40b7-593c-bbd4c19bd38b&zcluid=cc7b261466c376e2&zdid=1332

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700:10::6816:3362 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 93840da00b574315-EWR
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=CAESEGuBNgwyjUbu3VGOQU-F0dI&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3826f046-3e90-42df-6f27-2fde4385a520&reqId=10a0694a-4d74-40b7-593c-bbd4c19bd38b&zcluid=cc7b261466c376e2&zdid=1332
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 469
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame 45B8
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&sInitiator=external&gdpr=0&gdpr_consent=

42 B
603 B

48ms
47ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 4
Pragma: no-cache
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Wed, 30 Apr 2025 03:46:37 GMT
Content-Length: 42
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 6
Pragma: no-cache
Connection: Keep-Alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Date: Wed, 30 Apr 2025 03:46:37 GMT
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 45B8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjI2ODUyRDUtMzE3Ny00REJELUE1QTEtRjhDRkRBRTg3N0Ix&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFvxJSiW_c3hBgguoVS7AG0&google_cver=1

42 B
298 B

174ms
26ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFvxJSiW_c3hBgguoVS7AG0&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFvxJSiW_c3hBgguoVS7AG0&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Wed, 30 Apr 2025 03:46:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 45B8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ImhS1TF3Tb2lofjP2uh3sQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEBIu7sf9d9MsAo9f-5JTgOg&google_cver=1

10 KB
10 KB

31ms
30ms

Image
text/html

23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEBIu7sf9d9MsAo9f-5JTgOg&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=29753
content-encoding: gzip
expires: Wed, 30 Apr 2025 12:02:30 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Wed, 30 Apr 2025 03:46:37 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEBIu7sf9d9MsAo9f-5JTgOg&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Wed, 30 Apr 2025 03:46:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 45B8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFvxJSiW_c3hBgguoVS7AG0&google_cver=1

42 B
378 B

153ms
40ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFvxJSiW_c3hBgguoVS7AG0&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFvxJSiW_c3hBgguoVS7AG0&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Wed, 30 Apr 2025 03:46:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 45B8
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:1F5124B96CDD43B399F4EAE631828DBA

42 B
478 B

105ms
41ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:1F5124B96CDD43B399F4EAE631828DBA
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:1F5124B96CDD43B399F4EAE631828DBA
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 29 Apr 2025 03:46:37 GMT
access-control-allow-origin: *
content-length: 142
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 45B8
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=

42 B
392 B

154ms
42ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 29 Apr 2025 21:26:41 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=
content-length: 355
date: Wed, 30 Apr 2025 03:46:37 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 45B8
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-h.uDnCBE2uX0ASW7xrsTxFRgoYtn0Wc-~A&gdpr=0

0
261 B

170ms
48ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-h.uDnCBE2uX0ASW7xrsTxFRgoYtn0Wc-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 03:46:37 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-h.uDnCBE2uX0ASW7xrsTxFRgoYtn0Wc-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html
server: ATS

GET
H2 200 226852D5-3177-4DBD-A5A1-F8CFDAE877B1
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 45B8 43 B
519 B 226ms
89ms Image
image/gif 2600:1f18:4e9:5a05:a906:e81c:9a74:c47a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/226852D5-3177-4DBD-A5A1-F8CFDAE877B1?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a05:a906:e81c:9a74:c47a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 45B8
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=d63a2909-d831-435c-b2f5-047a8b0cccef&gdpr=0&gdpr_consent=

1 B
336 B

35ms
33ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=d63a2909-d831-435c-b2f5-047a8b0cccef&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: f7dea577-ab6c-4bbe-8a12-736d4b391f87
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=d63a2909-d831-435c-b2f5-047a8b0cccef&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Wed, 30 Apr 2025 03:46:37 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 174ms
46ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6192d7b9a03dc98c0490251dfd8f4f7b767bfb4c2726977fc3019a6635bdf342

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 8
cross-origin-resource-policy: cross-origin
cf-ray: 93840d9a5d30445f-EWR
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 30 Apr 2025 03:45:19 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 126 B
277 B 70ms
64ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35bf5b927ae18bab2b16d1d678d1dbe71c644b57b253c74e9f31c78929bed8db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 93840d9ac94b43b6-EWR
access-control-allow-origin: *
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

GET
H3 200 / Show response
fundingchoicesmessages.google.com/f/AGSKWxVIEUw2oO7lKUPdp71C1Zk7nApYD43iqNvtl7it31rUostEMCxXDcg2xlv5mFjeCBwS6U2qq1ILYZkYk3FsCduJjAecHVyNU2wURyfSv7v21luVJua5DrJlySbYPF_90lcFNsX6AX7RYsgwVacRedtp6TxFl... 54 B
109 B 56ms
56ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVIEUw2oO7lKUPdp71C1Zk7nApYD43iqNvtl7it31rUostEMCxXDcg2xlv5mFjeCBwS6U2qq1ILYZkYk3FsCduJjAecHVyNU2wURyfSv7v21luVJua5DrJlySbYPF_90lcFNsX6AX7RYsgwVacRedtp6TxFl0bYnvGgY5JHRvRo6giEqO5TgJOBHdCy/_/banneradsajax.-ad-refresh./adspot_/dif/?cid&adslots=

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.JicVSDHi2hU.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwq3Q97UOg5poK2v0pfLNMQLWuccQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3e9e52788150d658a0a708d186389dd9f8045f08c2846a05fa31c06e721d6c8b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Ob8qoUQoz08kTFbkdddnRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxk_Zt1i4gFuLhmLvr2AE2gRuNh24yKWkk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkamBiZ6xkYxBcYAACgvD9n"
content-security-policy: script-src 'report-sample' 'nonce-Ob8qoUQoz08kTFbkdddnRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 108ms
29ms Script
text/javascript 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.JicVSDHi2hU.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwq3Q97UOg5poK2v0pfLNMQLWuccQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d1e246486f5b83490b366d4d5f9eed0e72425ce3d6b997d3a331cbb047e161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 6293792072184911421
age: 1099
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 04:28:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 30 Apr 2025 03:28:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80731
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 126ms
49ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mI4z0ED3DPc5jKSDheExoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw1pBi-FB_mfUHEAvxcMzddewAm8CCcx1_mZRckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJkbmegXl8gQEAdqIkvQ"
content-security-policy: script-src 'report-sample' 'nonce-mI4z0ED3DPc5jKSDheExoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 176ms
45ms Preflight
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 93840d9a491343b6-EWR
content-length: 0
content-type: text/plain
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: Thu, 30 Apr 2026 03:46:37 GMT
server: cloudflare

POST
H3 204 AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 47ms
45ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce---iePmr76Oez_zpoFiEpgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII1JBi-FB_mfUHEAvxcMzddewAm8CDrlv_mJRckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJkbmegXl8gQEAj6QlEg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce---iePmr76Oez_zpoFiEpgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 32ms
31ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Wed, 30 Apr 2025 04:01:37 GMT
accept-ranges: bytes
content-length: 67550
date: Wed, 30 Apr 2025 03:46:37 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H3 204 AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 45ms
43ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-doXOGE8jtE8StG4kHy0Q_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw1JBi-FB_mfUHEAvxcMzddewAm8COq8_XMyu5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI3M9A_P4AgMAhF4k7A"
content-security-policy: script-src 'report-sample' 'nonce-doXOGE8jtE8StG4kHy0Q_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 46ms
45ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWa8EwXPK68IcjbqdblbmcYd31Mk2DqLGG5Aa0RU0Yn-s3DV8Sd52qX4tAd3p1pCdzo76lcrfiltqmO_XDCVOuj6bM-yFPzb552xrXI5cuXIEln7RpM12gug1afsqPYFuIlO_d6Ag==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lCHnCoKwMSTpddIllQvcoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0JBi-FB_mfUHEAvxcMzddewAm8CDw-s2MCu5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI3M9A_P4AgMAeokkyQ"
content-security-policy: script-src 'report-sample' 'nonce-lCHnCoKwMSTpddIllQvcoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUTVm9uTdn3j_X6eUXyEO-YNKr0Bs_FUSeyINJxIpsSw45AW76p33tqG6oIJZZMUbBhBgbzCZOUwvvEanDVtusNGd7mz9KxgK9puoi-LM1xAbjqYrkJcNDqnOvpmC3cdTx5F72tJA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 73ms
73ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUTVm9uTdn3j_X6eUXyEO-YNKr0Bs_FUSeyINJxIpsSw45AW76p33tqG6oIJZZMUbBhBgbzCZOUwvvEanDVtusNGd7mz9KxgK9puoi-LM1xAbjqYrkJcNDqnOvpmC3cdTx5F72tJA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1OTg0Nzk3LDg4NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJKaWNWU0RIaTJoVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJkaGZiZy5tYXJraXNmdWxsb2ZzaGl0LmNvbSJdLFsyNSwiW1s5NTM0MDI1Miw5NTM0MDI1NF1dIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c326562e5ce52433dabea404211ff33bf3f7f1bce385d4dd7560e7aa6ac84692

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6f2GHGrcHVvtcaVQY4Pzrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw0ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuujbdYDwFxk_Zt1i4gFuLhmLvr2AE2gR1rv-9hVtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDEy1zMwiC8wAACy-D-v"
content-security-policy: script-src 'report-sample' 'nonce-6f2GHGrcHVvtcaVQY4Pzrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D2F8
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=91452127-6d77-454d-9678-41206a260217&expiration=1748576798&gdpr=0&gdpr_consent=

43 B
764 B

113ms
51ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=91452127-6d77-454d-9678-41206a260217&expiration=1748576798&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TPwc8LZ43WSdthy7kZqHqWFBjxGoIFEsUokE7GYz3U90Rs9rB0AsT%2BiC5e3od0QkTeyo1PdHEAh3ACALNQ%2Fg6XwMVFOCqvaBWV3b6bU7oVxkQX99WfBbYbg9C694EiiSYh%2FGIufIMLjM8g%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93840d9c3f36438c-EWR
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=91452127-6d77-454d-9678-41206a260217&expiration=1748576798&gdpr=0&gdpr_consent=
content-length: 323
date: Wed, 30 Apr 2025 03:46:38 GMT
server: Kestrel

GET
H2

200

sync
nlsn.thrtle.com/ Frame D2F8
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aBGdHUt3uT4AKjwSASs4PAAA%26039&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=80b6b537-16f4-40e0-8fad-194cb3b10f5b&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=80b6b537-16f4-40e0-8fad-194cb3b10f5b&vxii_pid=12&vxii_pid1=7006&vxii_rcid=81cdba8e-4a00-4f1c-afbb-7e1f9ee0391d&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=81cdba8e-4a00-4f1c-afbb-7e1f9ee0391d
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=91452127-6d77-454d-9678-41206a260217
https://thrtl.redinuid.imrworldwide.com/thrtl?url=https%3A%2F%2Fnlsn.thrtle.com%2Fsync%3Fvxii_pid%3D5036%26vxii_ts%3D2
https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=b89e9f90-2575-11f0-9d57-5d6901eb7734
https://ib.adnxs.com/getuid?https%3A%2F%2Fnlsn.thrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D3%26_t%3D1745984798
https://nlsn.thrtle.com/sync?vxii_pid=5006&vxii_pdid=7646926639373327599&vxii_ts=3&_t=1745984798

43 B
541 B

56ms
56ms

Image
image/gif

100.28.240.119
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://nlsn.thrtle.com/sync?vxii_pid=5006&vxii_pdid=7646926639373327599&vxii_ts=3&_t=1745984798
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H2
Server: 100.28.240.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-28-240-119.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://nlsn.thrtle.com/sync?vxii_pid=5006&vxii_pdid=7646926639373327599&vxii_ts=3&_t=1745984798
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 044a0b52-aa03-4990-8c7a-e7c848fe52b9
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame D2F8
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aBGdHUt3uT4AKjwSASs4PAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEBYCW1gSGY6HAQ5oEzTLQ8A&google_cver=1

43 B
767 B

44ms
43ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEBYCW1gSGY6HAQ5oEzTLQ8A&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lk6jJlV12h9UpfFKxXivrDZUoqMQ2kvMs%2FpYz7MMCbckB0J0CWX%2BgljAmgUW0SbwgBBna1%2FRHyZ5LSpmIRiqcFyEdHlnbyjuOQxPLCa%2Be4cCmu5vzpoS7qgCgJ%2BosnllnGpTMnTGr77W3g%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93840d9cffd3438c-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEBYCW1gSGY6HAQ5oEzTLQ8A&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame D2F8 43 B
855 B 39ms
36ms Image
image/gif 98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aBGdHUt3uT4AKjwSASs4PAAAACcAAAAB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: T67J9F3BJ3F52ZGH78QQ
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 30 Apr 2025 03:46:38 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 pixel-index
www.temu.com/api/adx/cm/ Frame D2F8 0
370 B 230ms
97ms Image
text/plain 20.157.93.108
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL

https://www.temu.com/api/adx/cm/pixel-index?cm_user_id=aBGdHUt3uT4AKjwSASs4PAAAACcAAAAB

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.157.93.108 Washington, United States, ASN8069 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1745984798162|3
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1745984798162-734f171ab88398492d448101216c8d2d-3
cip: 206.66.99.36
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
server: nginx

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame D2F8
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub10256699365696&userId=aBGdHUt3uT4AKjwSASs4PAAA%26039&gdpr=&us_privacy=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=177d547e801e7b64&gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub10256699365696
https://t.adx.opera.com/sync?vendor=60369&pubid=pub10256699365696
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=225&&external_user_id=OPU1f7aed6399e240509e94aaab8d4432b3

43 B
768 B

41ms
40ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=225&&external_user_id=OPU1f7aed6399e240509e94aaab8d4432b3
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2%2BvlCpJptLglMh1J%2FbWFZL1udnfkRmjOYovT5PD2e%2BAbTXWYaD1uYi5SoxVt%2Be1qduXTMENFXN38antGGRBGGy4nIeiRfyyW6gNGF06RnvxVVoGVV6KpXjMLL3ITummZAnZyG8a6GMBL%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93840da02a90438c-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=225&&external_user_id=OPU1f7aed6399e240509e94aaab8d4432b3
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
expires: Mon, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
content-length: 136
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/html; charset=utf-8
server: Tengine
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame D2F8
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=2205788714523894302&gdpr=0&gdpr_consent=

43 B
773 B

55ms
54ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=2205788714523894302&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lPQKa%2FJngJmnfXlw6NxX3xAOocZPgSqp9Gw1ONbrwK%2FnpWucHk7p4cMblt%2FcxiMNAFegzcqPNpUZ%2F6%2BreiYYJdEjVFszA6V4bgh%2BC0hkkVm%2FzZ6Fv%2BZfj9fSox4iKqCLjjJpBjLNu6cN%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93840d9d0fea438c-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache,no-store
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=2205788714523894302&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Wed, 30 Apr 2025 03:46:37 GMT
pragma: no-cache

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D2F8
Redirect Chain

https://s.c.appier.net/index?userId=aBGdHUt3uT4AKjwSASs4PAAA%26039&gdpr=&us_privacy=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=_z3vVeiqB_i4z06GH50RaA&gdpr=0

43 B
763 B

46ms
46ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=_z3vVeiqB_i4z06GH50RaA&gdpr=0
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=48MTlm6apMkaG4ocFHnpK29vtvtoYzikfFCEH97%2BxSuobO3RZF%2BMVGxxFLN%2BbLVNqRIipzEEFin7fD6JRN7ozmM9tqdIGicn4AGouhQdbQCVJ1ZLbptbYvAzMiAxgMtCUrMH0yjbvdQ18g%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 93840da2dd28438c-EWR
content-length: 43
server: cloudflare

Redirect headers

Cache-Control: no-store
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=_z3vVeiqB_i4z06GH50RaA&gdpr=0
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Wed, 30 Apr 2025 03:46:39 GMT
Server: nginx

GET
H3 200 setuid
prebid.intergient.com/ Frame D2F8 0
607 B 48ms
47ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?gpp=&gpp=&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aBGdHUt3uT4AKjwSASs4PAAA%26039

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93840d9bae83a67e-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/html
vary: Origin
server: cloudflare
priority: u=3,i

POST
H3 204 AGSKWxUDd9Y84p7OFRtLJ7oOOPdWJczyXzGASFlxpsCYR2lYJ8siWsT8mhucCCpV5TUUDjsG8DUrBfEyUEdFZ6862EP6vUfN_VoF5p2GYrONTSG7NR-07d2q9WuK6STIIUmraqvMt9CjeA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 50ms
49ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUDd9Y84p7OFRtLJ7oOOPdWJczyXzGASFlxpsCYR2lYJ8siWsT8mhucCCpV5TUUDjsG8DUrBfEyUEdFZ6862EP6vUfN_VoF5p2GYrONTSG7NR-07d2q9WuK6STIIUmraqvMt9CjeA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-pgK4fSbiFh0hS5JBLzCeVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0pBi-FB_mfUHEAtxc8zbdewAm8COd0tElFyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRuZ6BeXyBAQA-dCQd"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-pgK4fSbiFh0hS5JBLzCeVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 195ms
43ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e3f84b2a779d78921849c67d98e91ee507be4fe504fc609bb4293bce0e5910e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 59
cf-ray: 93840d9cbce54225-EWR
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 30 Apr 2025 03:42:39 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
94 B 302ms
165ms Image
image/gif 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&halo_id=060ixedju6a65bebk9bd8k6ecadcjhbb8deuomkwi0e0ygmgy6gk4y0miekiwsgg4
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9c9effc64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 442ms
198ms Image
text/html 54.201.159.114
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.201.159.114 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-201-159-114.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&adnxs_id=7646926639373327599&gdpr=0

43 B
95 B

163ms
160ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&adnxs_id=7646926639373327599&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9cef88c64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&adnxs_id=7646926639373327599&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 9e8ee109-1380-4a11-9ac0-a53e9b7b76ce
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001745984798-R0MGL6PF-CABT%26auid%3DAU...
https://ids.ad.gt/api/v1/openx?openx_id=395d99e6-1584-4b13-947d-f31b5e99973c&id=AU1D-0100-001745984798-R0MGL6PF-CABT&auid=AU1D-0100-001745984798-R0MGL6PF-CABT

43 B
95 B

135ms
131ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=395d99e6-1584-4b13-947d-f31b5e99973c&id=AU1D-0100-001745984798-R0MGL6PF-CABT&auid=AU1D-0100-001745984798-R0MGL6PF-CABT
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9d1fc6c64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=395d99e6-1584-4b13-947d-f31b5e99973c&id=AU1D-0100-001745984798-R0MGL6PF-CABT&auid=AU1D-0100-001745984798-R0MGL6PF-CABT
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001745984798-R0MGL6PF-CABT
https://ids.ad.gt/api/v1/pbm_match?pbm=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&id=AU1D-0100-001745984798-R0MGL6PF-CABT

43 B
95 B

158ms
157ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&id=AU1D-0100-001745984798-R0MGL6PF-CABT
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9cef8ac64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&id=AU1D-0100-001745984798-R0MGL6PF-CABT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 03:46:37 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001745984798-R0MGL6PF-CABT&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&rub=MA3E9NRV-B-HOUF&gdpr=0

43 B
95 B

134ms
131ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&rub=MA3E9NRV-B-HOUF&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9d1fc9c64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&rub=MA3E9NRV-B-HOUF&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001745984798-R0MGL6PF-CABT&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=91452127-6d77-454d-9678-41206a260217&id=AU1D-0100-001745984798-R0MGL6PF-CABT

43 B
170 B

222ms
130ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=91452127-6d77-454d-9678-41206a260217&id=AU1D-0100-001745984798-R0MGL6PF-CABT
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9c9efbc64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=91452127-6d77-454d-9678-41206a260217&id=AU1D-0100-001745984798-R0MGL6PF-CABT
content-length: 259
date: Wed, 30 Apr 2025 03:46:38 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001745984798-R0MGL6PF-CABT&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001745984798...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001745984798-R0MGL6PF-CABT&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001745...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=950a8fe7-aabe-4409-b4f4-0028e575af22%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=91452127-6d77-454d-9678-41206a260217&ttd_puid=950a8fe7-aabe-4409-b4f4-0028e575af22%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&tapad_id=950a8fe7-aabe-4409-b4f4-0028e575af22

43 B
95 B

112ms
111ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&tapad_id=950a8fe7-aabe-4409-b4f4-0028e575af22
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9e192ec64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&tapad_id=950a8fe7-aabe-4409-b4f4-0028e575af22
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
server: Jetty(11.0.25)

GET
H3 200 pixel
cm.g.doubleclick.net/ 170 B
188 B 45ms
40ms Image
image/png 64.233.180.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001745984798-R0MGL6PF-CABT

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001745984798-R0MGL6PF-CABT
https://ids.ad.gt/api/v1/amo_match?turn_id=7896794668187917832&id=AU1D-0100-001745984798-R0MGL6PF-CABT

43 B
95 B

132ms
131ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=7896794668187917832&id=AU1D-0100-001745984798-R0MGL6PF-CABT
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9d2fddc64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=7896794668187917832&id=AU1D-0100-001745984798-R0MGL6PF-CABT
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 03:46:39 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d&gdpr=0

43 B
95 B

164ms
163ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9e59d9c64a-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745984798-R0MGL6PF-CABT&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 30 Apr 2025 03:46:38 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-187
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001745984798-R0MGL6PF-CABT
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTk4NDc5OC1SME1HTDZQRi1DQUJU

170 B
188 B

40ms
39ms

Image
image/png

64.233.180.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTk4NDc5OC1SME1HTDZQRi1DQUJU

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

64.233.180.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 93840d9cff9ec64a-EWR
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTk4NDc5OC1SME1HTDZQRi1DQUJU
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 123ms
110ms Fetch
text/plain 141.95.33.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 529ms
209ms Fetch
application/json 2001:41d0:701:1000::1e43
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::1e43 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: 61cdb7ecb2a21f3e5d94d9cad9fb9441599658395724c712627263da479b7b10

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 125ms
108ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

eb5c8da2f30e2e9993c45cd9472e4a28e574e495600321d30f0551064a07b48e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
4 KB 358ms
355ms Fetch
text/plain 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5310252927216063&correlator=1321200008176818&eid=31091876%2C31092019%2C95355263%2C83321072%2C95358556%2C95340252%2C95340254&output=ldjh&gdfp_req=1&vrg=202504240101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745984798126&lmt=1745984798&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdhfbg.markisfullofshit.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1Kkx4blBvWFFTeEtyaHRFMVhjSzZHZEs4SkhZTmZzVlludlZOWFlnMGJ3QWNVQ01yaDRxSGxvSjRETXZqMTRxVE1YARI0CgpwdWJjaWQub3JnEiRmZDM0NmY4Yi1lN2Y2LTQ5MzMtOGRiNC02MzEyY2IzNmI2NmVYARI3Cg1iaWRzd2l0Y2gubmV0EiQ5NGJhODAzOC1jYjk1LTRiM2ItYjVjZS0yZmU2ODI3ZjNhOGRYARI2CgxwdWJtYXRpYy5jb20SJDhCQzcxMUNGLUVCMkQtNDNDNy05NENFLUVCNTAxNDY3NjgyQlgBEj4KHGxpdmVpbnRlbnQuaW5kZXhleGNoYW5nZS5jb20SHFp2T0hsdEhNN3lFQUFGLnZBQjJ3ZWdBQSYwNDlYARIoChJydWJpY29ucHJvamVjdC5jb20SEE05OVJKRTk3LTE3LTlUWUhYARIdCg5lc3AuY3JpdGVvLmNvbRiV8bam6DJIAFICCGQSGAoJeWFob28uY29tGPX2tqboMkgAUgIIbxLuAQoIcnRiaG91c2US2AFQdEFZRTFReVRDaUxUbnZqQWFPMFlaYWNRQWpoeTVlN2R0TlFTWlpPUlZ2WGJ2THFJQTlneTNHbmF5ZjhpRjVVUzd6VnduNCsweDNZQ1ROSHNaWWxDMGVVQ1p4aFcvS25qNVdHT0lnZWJFYisrb05SMndnV0psYTczT1FBaHRCVjNYYnJ0dmdrNFB0Nkp4Tm42N1pmRVZrV1N4QzlaVURjMjBPUUpTS1hMS290MVkwWGVMTkFnU1ZXSXZ5a0sxTEttT2VLSVNRQzFGaVJxeTFwRC9GakpRPT0Y0fa2pugySAASFAoFb3BlbngY1fK2pugySABSAghvEhsKDDMzYWNyb3NzLmNvbRiV8bam6DJIAFICCGQSMwoJb3BlbngubmV0EiQ2NmIzNDQ3MS0xMDc0LTRmYTAtYjliYS0zOWM0Zjc3NDcyNGVYARKHAQoObGl2ZWludGVudC5jb20SczE0LU1ObndmTG9tdk5BS0FZMmtwYUx6MitKMGkvakNzZG1uYWZmME5RMGRGVDc1QXNrRUR0d1Nud0lyd1lhRkFoYTdRcUU0OVVHOE40WWgrTTEzdjNqekhQWU56V1JZaGkvczQxRndmaHBJYWZYVEhnPT1YARI1ChlsaXZlaW50ZW50LnRyaXBsZWxpZnQuY29tEhYyNzM1MDQ0MzUwNzYzODY1MTI4Mzc5WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745984795581&idt=876&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Dafa299da7bf14eacb2454f3886ed657884797070%26price_floor%3Dna%26bid_type%3Dserver%26hb_format%3Dbanner%26hb_adid%3D143f96f67312926a8%26hb_size%3D160x600%26hb_pb%3D0.12%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_cache_host%3Dprebid.adnxs.com%26hb_bidder%3Ds2s_pubmatic%26hb_cache_host_s2s_pu%3Dprebid.adnxs.com%26hb_format_s2s_pubmat%3Dbanner%26hb_size_s2s_pubmatic%3D160x600%26hb_pb_s2s_pubmatic%3D0.12%26hb_adid_s2s_pubmatic%3D143f96f67312926a8%26hb_bidder_s2s_pubmat%3Ds2s_pubmatic%26hb_format_pubmatic%3Dbanner%26hb_size_pubmatic%3D160x600%26hb_pb_pubmatic%3D0.04%26hb_adid_pubmatic%3D1346b5a1a03d9f9d%26hb_bidder_pubmatic%3Dpubmatic&cust_params=pf_src%3Dml%26amznbid%3D1%26amznp%3D1%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26li-module-enabled%3Dt1-e1%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fdhfbg.markisfullofshit.com%252F%26tyche_code%3DV.20250423.1%26pageos_code%3DV.20250423.1%26config_id%3D1024872_74068_primary_config%26hour%3D17%26day%3DTuesday%26referrer_domain%3Ddhfbg.markisfullofshit.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250423.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=8765&tan=b91153dc-bfe8-499b-b062-fff6537d6b0b&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7111fbbe1f74802efc7c3edbec37a66ebc410cc55569c1fd21cac021e1ebee16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 6471729968
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138458642801
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 3850
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
23ab3e82f2eca9dca149794e66680fbd.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 1743 7 KB
3 KB 145ms
34ms Document
text/html 2607:f8b0:4004:c1f::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://23ab3e82f2eca9dca149794e66680fbd.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 03:46:38 GMT
expires: Wed, 30 Apr 2025 03:46:38 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 320 KB
112 KB 46ms
45ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

38392590a29469a3d0ae7f09209bb0d279d099e07397ae8754ae29709755f425

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1072:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1072:0"}],}
expires: Wed, 30 Apr 2025 03:46:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1072:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1072:0
content-length: 114461
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
113 B 183ms
175ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9d197f445f-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 319ms
130ms Script
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 93840d9e9f88184d-EWR
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:38 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 481 B
237 B 134ms
127ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8954de324eb4ffffc6fce71bece63247bf4115688ba1435b3567ae9020e0d100

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 93840d9f3d704338-EWR
access-control-allow-origin: *
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 338ms
136ms Preflight 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 93840d9e5cb24338-EWR
date: Wed, 30 Apr 2025 03:46:38 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 05F2 0
0 44ms
44ms Fetch
image/gif 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssaeG7of11ujaK0YubWYVHbsAEQ1e0SVnZFjUaGTTkn8M_F_GbDw_ZUpBvxaB7059ECpAVWTW8owXvIbhK6bX6zk3ZqfmQjT6QIvaBYn83UllMht2cNMANrs6HVIe68N0eawsgDeolVeJjJFRct29mJSW8uEQFdkLv-Kc_BWcQuiLZyIHOvrncW0Izwps4ddkOdkCJzesG_RHxPHtfOSGMi3vUDfm7WFR-8Mo6wRnb0-vzqiMVLPz-96Y487X8r1Vu7KNPhq59UrZGGQXEjIrAGbvLgKVSLUkuP6UxuG0m42saBLsN_7Im52gFszm8hjyxjeC8WX8G6AbPLD7l7VzbKlvluTYJV1Mz0W-foi8FY8WtwOgn9H7boOzqEAMHofejMJaYllm_OQH3Py7p4yI8ycjtd4biPGRVp-78RwttmrtyZXRjOjTEsrPAYq4v8PicmfOXRhd9_5JYZGD_8QAGOYIJJCHO5PTejwU6fWSTQ1ywEp_S-pt0oWVQFI491uFUJspU6dJvuzBc8sOgLHle2eY7L6L36n6_smGU6E80L2O7KaMSm7cRikWN8o6ytbGNS8m0AJVrxOYbGKz-GyzlVni08lQ&sai=AMfl-YRiVigHH-DhtvaMp30WlPDjK0AB-xfxidAllV7tg9Mhftt1XDUyS3Il5qv2OGs18nxGxlKcl7qpnZyqy1L6hZh0M-G1nn0zc4FEcnOtqyAyiM1Hk_nK6z6Twcoa&sig=Cg0ArKJSzHOSAIpWW2glEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 AdDisplayTrackerServlet Show response
pn.ybp.yahoo.com/ab/imp/04f3LwizdEAsZEqZ0samYMq8NTqsUBkohmb3_NscFkLJmCdjDJ6Q_ginLQyLHcwGXFWtRdqEAZ-L0EVxTGz2SKCS1ncles1dUDRWfhuc-_WeobAQBntg8qYyNXaNAaCgnNc9D5C3FG07pQGq1n8cyIBCd6ZrWM8xjAAzxAYfgCRuK... Frame 05F2 3 KB
2 KB 192ms
32ms Script
text/javascript 2600:1f18:2352:af01:373d:4b25:62ce:85ce
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://pn.ybp.yahoo.com/ab/imp/04f3LwizdEAsZEqZ0samYMq8NTqsUBkohmb3_NscFkLJmCdjDJ6Q_ginLQyLHcwGXFWtRdqEAZ-L0EVxTGz2SKCS1ncles1dUDRWfhuc-_WeobAQBntg8qYyNXaNAaCgnNc9D5C3FG07pQGq1n8cyIBCd6ZrWM8xjAAzxAYfgCRuKbik0zPulRDp3Ol6QhGhjcvNTV9Fx9V_ga8OfHZhktJ-bupuFi-v34unesIHzw-YG0P9F92lRzgj76y60w10sEb3UfArCjVukB7HRRe3NE9x3rNrs_mxET3IVkjLxhVtad4k9aQtjFePHnwwlQmmvvhcz61izY1r_Zh0tpfaCjywiNm5Z4G84qiZmydh7zgQKaccZwR9r0sMci_nBGscuYs5NG1d782dAOU6639P6EnrYKIBEF2QJ0NA_Av2GEEQfUYvQNoLM1WMzaS4UMV1BLf7t-l1d6G8HQrjdywcEcvrQYxQoBT0jd68h_9svBBUpzcllw8s5Cdxlo3TKHtMWWdpVHEr1hmrLehChJ1HCxovAfkR6oBBa6x_4hGQC3jycUGAJzZg8ZRi3Lh9CBEYI8fJ5zn5Axc3ZgsnqEjwW8FoeJx9sOjM1CzvUMfdKTDb_Y_p7woxdMZmO60zc4w-rQOI3A7NRAmQmMzOF3nzd2a6ynQzdbsU0qSUPNCCQwHzMae9gIppiwChm0Cbcw_iy3NJGY1VqkggRFeQDbc8eHpWJ_2YhibCYddocZ8yuIphet4yamF1R6Yq0Ie3zrwjChhs0EIGJy_RSWc3xDmRAwLVSRmr6_kgd2oqGNqdXEYdDihzOKE74poZOmhjnsuh5s3Sm8TOA1y1ja-2LRn5K8wEbZmXL1zzw3NgbIMve1ZcVKftrJ3frqhmYKXeLxDYBgs5oJhTcnXINclUKjYCIGGakM4Tu4P4sollB74htqyantuy_SOnCtpj-p474Y0Wj2qjCsP8JhdBPuEI3FHSVUxbNCg1LigKm_rWFgxy2zivBX3tD7ExSFOo7pSeo0w05jMCqoiU4-hmM5oj8l7drhhC3BnUfrGu0t8SJqhWM5itthZosQGBQO98hnwMsTh6dZeX-utJCL_P18igNIP3TRx4EGLzGZ4c5PqaH7Af6pvgdEapObsoigPlcJd-Eu0-2oqoeEPmCvtspCQRUKEfk8NB_k6bKxtd65IRxhk1Tauk92kyT0ZThwUiZ2S819GUHrP_4upcpbGmucDSX_tNnq8j-NBx1OBF79sb3N7L5ksRz6DzQspOf3KT4rhphkxptFf1O4eSiDGC_8Bhs56V-pl7iTrPRbnE7CpvaAiakbuQL2Q6hjbLz-p-0jtNPBioSQ1POvNegsO4yfL5PhvVQe5GOSelorysTXmf_VP2HWSlb-zogyZ030Trw09lvBZxJ2D9CAjjdVE_3pPW__z0u5zZ3YBNxOSVOTc90MmRPIyE2OVkqJKjMNviUd_eZUaWhWWRowFIeFSdqtPGMUi64TD4QIfNB6BqRIHbVcuoGQGRVRS0CzeucXlVoyC3GzHn8B5Q0TBO9isUT3VmSqJ1V4SDCOeKIkqidiyJlaIT7l0LoZpGHj8HHirjpEagY38pZCfUmyX0AtBoAVAHjAru1STHC1wOqoM6wcZjBaJz0sbEDB2GRoGqZPLIXyn0-EXFD5kpV-i7QBEk5aOX5m2ezZ9AXKq65Vs9Q0fSjLYywprJ8jVNyBtqsl6JDs8kkLXr_uJWEvxjNJizmM0MzlBuwgp_uJcwPl455_pO8dLd3e-937h5Wm6xi1USIcDchfmOL7b5sJ1GlRyC0dpVFH9--KEw0CgLyphBlxQ1IXTNhR47DSM-89acHfIQ8r1yXFrKo2vnotLk42oUn18Fa9mfpSZ4-g3dziNzqU0dcvcceV-fZt_wiC9g2i_Gi3pcimDvG8dL9QSU2FlAloR9R4es3uBi9CCgHQqGyl0CQm2JXyeb7TDhSlvzRpjRrzcaROYgnuY06zwxdMu0jPtAM96QFZqig9abol-JMgnp1NNMSb201VnmOXHI9i7_P4RisuBgTJ0CVMHzrYI6C6Hg5iLVZ2ec7RgiIr4N_p0nPoInaSHdMBvAAK0cIOpWvx3D86kBt7pMwH_q6Ek/wp/0.160045/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1ODMyNiZzaXRlSWQ9MTE2NTMzOCZhZElkPTU2MzUyNTkma2Fkc2l6ZWlkPTEwJnRsZElkPTAmY2FtcGFpZ25JZD0yMzAyNiZjcmVhdGl2ZUlkPTAmdWNyaWQ9MTc4MTgwODIzNTMyNjU5OTIyNzMmYWRTZXJ2ZXJJZD0yNDMmaW1waWQ9QUVFNTM3MUYtOTQwNC00RUNDLUEwQzgtODc2NTdBQ0VCQjMyJnBhc3NiYWNrPTA=_url=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:2352:af01:373d:4b25:62ce:85ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

713651fba345295e888a6e505d200bbf26c128daf51fcc8193b5193a5b92e422

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
content-encoding: gzip
pragma: no-cache
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: *
content-length: 1819
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/javascript
vary: Accept-Encoding
server: ATS
x-frame-options: DENY

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 05F2 220 KB
68 KB 33ms
32ms Script
text/javascript 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0923ca035ce2e912178eb2032b148668aa905613119db6bf7a16df9178b54eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 360109090404770869
age: 1116
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 04:28:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 30 Apr 2025 03:28:02 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69331
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 4F80 52 KB
17 KB 164ms
30ms Document
text/html 23.218.216.28
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.216.28 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-218-216-28.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 30 Apr 2025 03:46:38 GMT
ETag: "623de86a-cf34"
Expires: Thu, 01 May 2025 03:46:40 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame FEA1 11 KB
4 KB 134ms
58ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e&neustar.biz=E1:SXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE+jA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi+umoCvnoofCaZqUrz+V/9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5/aBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH+nD7+CKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy+wNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT+zy+eBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg/Dee/GStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4/RJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd+jaH6P2kaicD687Cd9iV199ubulUc++RU19IbSIkNxDhQxqoMHqTQh/blRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe+uwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF/Qg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM+q/ga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv+kjKtlE5NN/r/uNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z+RSreoRsIt9atVu3lGUpxhBagAbYQjkKJed/xCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ+M74QO+ueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw/mBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu+cq7tc+vVsrgrjvaXsRud26ChB81gQlHTebgaB3g6/l1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh+BDD3niCquFdu+BGIjUFio&liveintent.com=14-MNnwfLomvNAKAY2kpaLz2+J0i/jCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh+M13v3jzHPYNzWRYhi/s41FwfhpIafXTHg==&bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d&liveintent.triplelift.com=2735044350763865128379&media.net=3811953486957097000V10&rubiconproject.com=M99RJE97-17-9TYH&liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA&049&openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e&pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B&sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10&liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0&linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745984797777&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f47c4cf0c89834579e0e9d000e8622d8e6e07d6478e9d63b3d839cf8713032c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 93840d9f8bb36991-PHL
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 03:46:38 GMT
expires: 0
last-modified: Tue, 22 Apr 2025 13:00:55 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 0D33 3 KB
2 KB 162ms
44ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 226
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 93840d9fdb966a5b-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 30 Apr 2025 03:46:38 GMT
expires: Wed, 30 Apr 2025 07:46:38 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3F38 20 KB
7 KB 29ms
27ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=29752
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Wed, 30 Apr 2025 03:46:38 GMT
expires: Wed, 30 Apr 2025 12:02:30 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 28C6 269 B
379 B 361ms
242ms Document
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 30 Apr 2025 03:46:38 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 49BF
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
2 KB

59ms
56ms

Document
text/html

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 5412619062ca1532ed36b4ca676104149e6950d9b2b063290b1530800b1fc4d0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 03:46:38 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
location: /sync?&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 9E7A 16 KB
6 KB 39ms
35ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e85f2ae34f4130d556d41515cf2f10770c2eec8fe152dea36e8bba1a3ceb9896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 03:46:37 GMT
server: Kestrel
server-processing-duration-in-ticks: 789167
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 35FE 0
0 208ms
46ms Document
text/plain 137.184.23.100
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.23.100 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Wed, 30 Apr 2025 03:46:38 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 0221 803 B
1 KB 63ms
32ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 44fe30f1820c69569efbf1e33d4798817e62d2d6c43e67c792f3c73d22fff5d9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Wed, 30 Apr 2025 03:46:38 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.36

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 30ms
25ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=jNfiRV82Q3Y5Y01NWU1zajkySTZtU1NvJTJGNUVncUx4V1E0ckNxUyUyQiUyQldoaEtnek1BeGY1cDFrYTJSMWtUczdBaUxZY08lMkY1Q3p3cFVQRExzMlBnQjh4T1ZXdW1DbUVwNzVJZFZmMCUyRllnd3o2TGdvY2M5MXNRMCUyQm1hUXo4eDlTS0xVNGxMbFVSa3JJcyUyRk5BeXljZ0xEME9TeHdXUSUzRCUzRA&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 208673
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 246ms
244ms Fetch
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-44-215-96-223.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
662 B 34ms
30ms Fetch
application/javascript 52.201.17.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.17.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-17-141.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: d469b6942a2ca61e458b9582c4bfafa20ee3b0a28b72d71704fa5090135c32a5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 37ms
31ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&tp=R2nLLSzz9VUa310dYhnGkb5xUK%2ByUauveetjd8qodtQ%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7ee6cb6d68d7d686784312f4bd783c3cbe92c8adf85969e0c651c7b9f69d48f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 519 B
0 3ms
3ms Fetch
text/plain 54.84.72.103
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jt2cvdysxt6b0687c7yhhv5b&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.72.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-72-103.compute-1.amazonaws.com
Software: /
Resource Hash: 6f5eb9eb502758ee2727ff0a3b0e06d3668cc1f4b30d71aed4fef2d650c44787

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: c3e45debf6cd1fe9
request-time: 10
access-control-allow-credentials: true
expires: Thu, 01 May 2025 03:46:36 GMT
access-control-allow-origin: https://paint.toys
content-length: 519
date: Wed, 30 Apr 2025 03:46:36 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=jNfiRV82Q3Y5Y01NWU1zajkySTZtU1NvJTJGNUVncUx4V1E0ckNxUyUyQiUyQldoaEtnek1BeGY1cDFrYTJSMWtUczd...
https://mug.criteo.com/sid?cpp=bHmwd3xVWFphNzBOSzhFZGpJMUQyMlhTN1pnVmhzYWY2dEZlWFJINlUzKzZMSjQwSnFKeVdDcFVVb1lxYUx0Zi91czQ3bTdkRjhJenIxM3ZrN1BWMTBnM01wSStHUjZaaWlIT2YwM1RwMzN2VGg5Y0VIbitnRytEb0ZGQU...

415 B
1 KB

29ms
27ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=bHmwd3xVWFphNzBOSzhFZGpJMUQyMlhTN1pnVmhzYWY2dEZlWFJINlUzKzZMSjQwSnFKeVdDcFVVb1lxYUx0Zi91czQ3bTdkRjhJenIxM3ZrN1BWMTBnM01wSStHUjZaaWlIT2YwM1RwMzN2VGg5Y0VIbitnRytEb0ZGQU9vUlRtM1R5cDVmdTJCYTJXeW9kenRJSkdaUjBUanNFS2g2aVFjREk1K3V0OUJxNkxYTUNMbWxQTTROQ0hrejlzSFR1MCtBemtuTlR6ODUzeVUxVlNjaStlTW1TMEp6Tm02QVZWWkN0Ri9ybEp1bzVnNFl6dVhiV3hTY20yQXE4alpVNnhFVW5MdHB3dlNKQkhqekxLK21Fa2Q2OENURnVkSHVIMUFWd3RyM1U1VlZaYkZBYzJpeHRMRXF4bmZBaitFTjArdWVxZnEyeEMzSVQ1T20reU4vWXQrVFJ3aEE9PXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8c0050be71f4c454fc8a3369c1c508b4dcff1f38ff8a18b34ff02344c251b579

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 711335
expires: 0
access-control-allow-origin: null
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=bHmwd3xVWFphNzBOSzhFZGpJMUQyMlhTN1pnVmhzYWY2dEZlWFJINlUzKzZMSjQwSnFKeVdDcFVVb1lxYUx0Zi91czQ3bTdkRjhJenIxM3ZrN1BWMTBnM01wSStHUjZaaWlIT2YwM1RwMzN2VGg5Y0VIbitnRytEb0ZGQU9vUlRtM1R5cDVmdTJCYTJXeW9kenRJSkdaUjBUanNFS2g2aVFjREk1K3V0OUJxNkxYTUNMbWxQTTROQ0hrejlzSFR1MCtBemtuTlR6ODUzeVUxVlNjaStlTW1TMEp6Tm02QVZWWkN0Ri9ybEp1bzVnNFl6dVhiV3hTY20yQXE4alpVNnhFVW5MdHB3dlNKQkhqekxLK21Fa2Q2OENURnVkSHVIMUFWd3RyM1U1VlZaYkZBYzJpeHRMRXF4bmZBaitFTjArdWVxZnEyeEMzSVQ1T20reU4vWXQrVFJ3aEE9PXw&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 317946
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
server: Kestrel

GET
H2 200 sync
x.bidswitch.net/ 43 B
103 B 262ms
111ms Image
image/gif 35.211.202.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif

GET
H2

200

ibs:dpid=903&dpuuid=91452127-6d77-454d-9678-41206a260217
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=91452127-6d77-454d-9678-41206a260217

42 B
714 B

31ms
30ms

Image
image/gif

44.215.96.223
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=91452127-6d77-454d-9678-41206a260217

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

44.215.96.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v076-03f79101c.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: KurHXfReQoE=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=91452127-6d77-454d-9678-41206a260217
content-length: 189
date: Wed, 30 Apr 2025 03:46:39 GMT
server: Kestrel

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 3723 0
100 B 352ms
40ms Document
text/plain 34.192.22.117
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.22.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-22-117.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 222ms
220ms XHR
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

8fcde8ffb76afc0d8030dfe20444d96166b014304f42710e22345c136c44a716

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/json
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/ Frame 9E7A
Redirect Chain

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&bundle=jNfiRV82Q3Y5Y01NWU1zajkySTZtU1NvJTJGNUVncUx4V1E0ckNxUyUyQiUyQldoaEtnek1...
https://mug.criteo.com/sid?cpp=XNtTwHw2MDBtd2wxUU80R3Y1SFJ3empscmduZWlqTkJsM1p3RVNFOEVPejFxRFdRU0lOLzBCOUMycFRxMXFWcHduS2FFQVVVT0JYbFVjWXAvWFZpY0ZuNWFHalJmTXBFV2Flb3pwdUlTUnczS24zaVJuNFMxRmNPSnQvdH...

2 KB
2 KB

30ms
29ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=XNtTwHw2MDBtd2wxUU80R3Y1SFJ3empscmduZWlqTkJsM1p3RVNFOEVPejFxRFdRU0lOLzBCOUMycFRxMXFWcHduS2FFQVVVT0JYbFVjWXAvWFZpY0ZuNWFHalJmTXBFV2Flb3pwdUlTUnczS24zaVJuNFMxRmNPSnQvdHVoU2NBQXVldnV4WlQ3dEhWcVlRMUdWelI1SkNOK0JESzJMVmtRQ0k5VEtWNzluQzE2YjU2dTdNWXlWQUd0Zmc5RlkyN2w5bi95U0lwUjFxcWJlTDNiTUVoVm1QNkIwVTVldHpPZ21TcHBoNWJOOEVhSXE2dmZxNzExZmpkRW02bjRrK3dQdlhhL1JhcHFrdnNpMVNXVVFrZTJBWXVIOXE3N3ZjZ1FFVEpuWDFJT1dmd0FVOUVJSEJTUExwMmxRMHpZajcxZ20yNnw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

88a10ec2bd79ac61c965f4bee34f079bfca685346eece37a12a99985bcfa1ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1143988
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=XNtTwHw2MDBtd2wxUU80R3Y1SFJ3empscmduZWlqTkJsM1p3RVNFOEVPejFxRFdRU0lOLzBCOUMycFRxMXFWcHduS2FFQVVVT0JYbFVjWXAvWFZpY0ZuNWFHalJmTXBFV2Flb3pwdUlTUnczS24zaVJuNFMxRmNPSnQvdHVoU2NBQXVldnV4WlQ3dEhWcVlRMUdWelI1SkNOK0JESzJMVmtRQ0k5VEtWNzluQzE2YjU2dTdNWXlWQUd0Zmc5RlkyN2w5bi95U0lwUjFxcWJlTDNiTUVoVm1QNkIwVTVldHpPZ21TcHBoNWJOOEVhSXE2dmZxNzExZmpkRW02bjRrK3dQdlhhL1JhcHFrdnNpMVNXVVFrZTJBWXVIOXE3N3ZjZ1FFVEpuWDFJT1dmd0FVOUVJSEJTUExwMmxRMHpZajcxZ20yNnw&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 312114
expires: 0
content-length: 0
date: Wed, 30 Apr 2025 03:46:37 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0221
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPc8YzwPucNftWRUbxRGPYI&google_cver=1

43 B
61 B

35ms
32ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPc8YzwPucNftWRUbxRGPYI&google_cver=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPc8YzwPucNftWRUbxRGPYI&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 0221 170 B
188 B 53ms
52ms Image
image/png 64.233.180.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=M2M3MjUzNDktNTU3Zi0yYTRiLWQyNjYtYmRmMjgzMDQ5NjU4

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 0221
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=101d8083-9c08-74ef-c786-e74b49e65838&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=OTE0NTIxMjctNmQ3Ny00NTRkLTk2NzgtNDEyMDZhMjYwMjE3&gdpr=0&gdpr_consent=&ttd_tdid=91452127-6d77-454d-9678-41206...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=91452127-6d77-454d-9678-41206a260217&google_gid=CAESECS7R97l-UquL3Ov68CCZcI&google_cver=1
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=91452127-6d77-454d-9678-41206a260217
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=7646926639373327599&ttd_tdid=91452127-6d77-454d-9678-41206a260217
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

28ms
27ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Wed, 30 Apr 2025 03:46:39 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0221
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/84dae6c7-0ca4-e6a6-f651-f1beb6b19571?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-baI0YHVE2p9cW6PgoAUTExmgR.xfOTKFQwA-~A

43 B
61 B

38ms
38ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-baI0YHVE2p9cW6PgoAUTExmgR.xfOTKFQwA-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:37 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-baI0YHVE2p9cW6PgoAUTExmgR.xfOTKFQwA-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 0221
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aBGdHgANhDqWcABh

85 B
169 B

32ms
30ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aBGdHgANhDqWcABh
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1745984799.986220,VS0,VE0
age: 16
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/png
x-served-by: cache-ewr-kewr1740028-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 19

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aBGdHgANhDqWcABh
x-timer: S1745984799.922832,VS0,VE8
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
x-served-by: cache-ewr-kewr1740028-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0221
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=7896794668187917832&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

39ms
38ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=7896794668187917832&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=7896794668187917832&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 03:46:53 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 29ms
27ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 30 Apr 2025 03:46:37 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 192402
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame FEA1 19 KB
7 KB 251ms
48ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e&neustar.biz=E1:SXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE+jA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi+umoCvnoofCaZqUrz+V/9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5/aBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH+nD7+CKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy+wNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT+zy+eBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg/Dee/GStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4/RJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd+jaH6P2kaicD687Cd9iV199ubulUc++RU19IbSIkNxDhQxqoMHqTQh/blRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe+uwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF/Qg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM+q/ga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv+kjKtlE5NN/r/uNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z+RSreoRsIt9atVu3lGUpxhBagAbYQjkKJed/xCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ+M74QO+ueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw/mBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu+cq7tc+vVsrgrjvaXsRud26ChB81gQlHTebgaB3g6/l1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh+BDD3niCquFdu+BGIjUFio&liveintent.com=14-MNnwfLomvNAKAY2kpaLz2+J0i/jCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh+M13v3jzHPYNzWRYhi/s41FwfhpIafXTHg==&bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d&liveintent.triplelift.com=2735044350763865128379&media.net=3811953486957097000V10&rubiconproject.com=M99RJE97-17-9TYH&liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA&049&openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e&pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B&sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10&liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0&linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745984797777&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 93840da14ff25e7f-EWR
access-control-allow-origin: *
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame FEA1 4 KB
1 KB 75ms
68ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e&neustar.biz=E1:SXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE+jA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi+umoCvnoofCaZqUrz+V/9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5/aBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH+nD7+CKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy+wNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT+zy+eBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg/Dee/GStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4/RJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd+jaH6P2kaicD687Cd9iV199ubulUc++RU19IbSIkNxDhQxqoMHqTQh/blRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe+uwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF/Qg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM+q/ga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv+kjKtlE5NN/r/uNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z+RSreoRsIt9atVu3lGUpxhBagAbYQjkKJed/xCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ+M74QO+ueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw/mBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu+cq7tc+vVsrgrjvaXsRud26ChB81gQlHTebgaB3g6/l1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh+BDD3niCquFdu+BGIjUFio&liveintent.com=14-MNnwfLomvNAKAY2kpaLz2+J0i/jCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh+M13v3jzHPYNzWRYhi/s41FwfhpIafXTHg==&bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d&liveintent.triplelift.com=2735044350763865128379&media.net=3811953486957097000V10&rubiconproject.com=M99RJE97-17-9TYH&liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA&049&openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e&pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B&sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10&liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0&linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745984797777&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f671454fce6d279e1eea87d0a505dd495df8891a9dc6c5027a9b1167c6310103

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e&neustar.biz=E1:SXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE+jA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi+umoCvnoofCaZqUrz+V/9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5/aBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH+nD7+CKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy+wNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT+zy+eBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg/Dee/GStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4/RJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd+jaH6P2kaicD687Cd9iV199ubulUc++RU19IbSIkNxDhQxqoMHqTQh/blRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe+uwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF/Qg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM+q/ga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv+kjKtlE5NN/r/uNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z+RSreoRsIt9atVu3lGUpxhBagAbYQjkKJed/xCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ+M74QO+ueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw/mBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu+cq7tc+vVsrgrjvaXsRud26ChB81gQlHTebgaB3g6/l1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh+BDD3niCquFdu+BGIjUFio&liveintent.com=14-MNnwfLomvNAKAY2kpaLz2+J0i/jCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh+M13v3jzHPYNzWRYhi/s41FwfhpIafXTHg==&bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d&liveintent.triplelift.com=2735044350763865128379&media.net=3811953486957097000V10&rubiconproject.com=M99RJE97-17-9TYH&liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA&049&openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e&pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B&sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10&liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0&linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745984797777&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 93840da00c0f6991-PHL
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2

200

cs
cs.yellowblue.io/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=KCLqX19sY2xQNDRSVUlqUzNzSnpFdERUc3N3MkdiR0Y3WjVWVDlTNjd2OFNaalk4JTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-NI3llPlZqr5Y4gWv...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=KCLqX19sY2xQNDRSVUlqUzNzSnpFdERUc3N3MkdiR0Y3WjVWVDlTNjd2OFNaalk4JTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-NI3llPlZqr...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a&ssp=criteo&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10609565930862161014&ssp=criteo&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10609565930862161014&ssp=criteo&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=criteo
https://x.bidswitch.net/sync?dsp_id=419&user_id=10609565930862161014&ssp=criteo&gdpr=&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=TkOF718yejBMaCUyQmlWcUxhelJUcTglMkY2VjFCbEVkRkt2MUNPajJxYVklMkY5SkFDa1dxNjg5Q1NGdE04S0N0Q1E1JTJCZWQlMkIyeWYxWG80WjJQaWlhYUl3VnZSUU5OWE9CQXIxM3cwS2dGemt...
https://cs.yellowblue.io/cs?fwrd=1&aid=11614&id=k-2_ZDDvlZqr5Y4gWvOsIU5GZ_DTzyEiXBgCHLrw

0
348 B

139ms
41ms

Image
application/javascript

3.223.46.7
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11614&id=k-2_ZDDvlZqr5Y4gWvOsIU5GZ_DTzyEiXBgCHLrw
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.223.46.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-46-7.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11614&id=k-2_ZDDvlZqr5Y4gWvOsIU5GZ_DTzyEiXBgCHLrw
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dFneWA19JNmsxSkE4bkclMkJ2VlEzVlBQWEhraDElMkJnVnR4NmhyQkl3SVB6STl2N0thUSUzRA%26u%3d%24UID&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=FneWA19JNmsxSkE4bkclMkJ2VlEzVlBQWEhraDElMkJnVnR4NmhyQkl3SVB6STl2N0thUSUzRA&u=7646926639373327599&gdpr=0&gdpr_consent=

0
141 B

207ms
61ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=FneWA19JNmsxSkE4bkclMkJ2VlEzVlBQWEhraDElMkJnVnR4NmhyQkl3SVB6STl2N0thUSUzRA&u=7646926639373327599&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Wed, 30 Apr 2025 03:46:38 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://ssp-sync.criteo.com/user-sync/match?p=FneWA19JNmsxSkE4bkclMkJ2VlEzVlBQWEhraDElMkJnVnR4NmhyQkl3SVB6STl2N0thUSUzRA&u=7646926639373327599&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: efb896b8-a840-4dba-adae-4f4bdf134ec4
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-NI3llPlZqr5Y4gWvOsIU5GZ_DTyWvfi3VbspMw&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
https://ssp-sync.criteo.com/user-sync/match?p=IKtsaF96b2lXczVKTGlKeGolMkYlMkZkNVhBb08wUWZrd3NMODBuMDdJZnptJTJGMnRPU3c4JTNE&u=CAESEDcsFk2WY971PdvCO_GWx3Y&gdpr=0&gdpr_consent=&google_cver=1

0
141 B

207ms
64ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=IKtsaF96b2lXczVKTGlKeGolMkYlMkZkNVhBb08wUWZrd3NMODBuMDdJZnptJTJGMnRPU3c4JTNE&u=CAESEDcsFk2WY971PdvCO_GWx3Y&gdpr=0&gdpr_consent=&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Wed, 30 Apr 2025 03:46:38 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/match?p=IKtsaF96b2lXczVKTGlKeGolMkYlMkZkNVhBb08wUWZrd3NMODBuMDdJZnptJTJGMnRPU3c4JTNE&u=CAESEDcsFk2WY971PdvCO_GWx3Y&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 400
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=7896794668187917832

0
145 B

207ms
60ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=7896794668187917832

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=7896794668187917832
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 03:46:36 GMT

GET e805be652c9053b8f771665f0ac3c361.gif
cs.admanmedia.com/ 0
0

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 05F2 17 KB
8 KB 197ms
42ms Script
text/javascript 2607:f8b0:4004:c07::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: pn.ybp.yahoo.com
URL: https://pn.ybp.yahoo.com/ab/imp/04f3LwizdEAsZEqZ0samYMq8NTqsUBkohmb3_NscFkLJmCdjDJ6Q_ginLQyLHcwGXFWtRdqEAZ-L0EVxTGz2SKCS1ncles1dUDRWfhuc-_WeobAQBntg8qYyNXaNAaCgnNc9D5C3FG07pQGq1n8cyIBCd6ZrWM8xjAAzxAYfgCRuKbik0zPulRDp3Ol6QhGhjcvNTV9Fx9V_ga8OfHZhktJ-bupuFi-v34unesIHzw-YG0P9F92lRzgj76y60w10sEb3UfArCjVukB7HRRe3NE9x3rNrs_mxET3IVkjLxhVtad4k9aQtjFePHnwwlQmmvvhcz61izY1r_Zh0tpfaCjywiNm5Z4G84qiZmydh7zgQKaccZwR9r0sMci_nBGscuYs5NG1d782dAOU6639P6EnrYKIBEF2QJ0NA_Av2GEEQfUYvQNoLM1WMzaS4UMV1BLf7t-l1d6G8HQrjdywcEcvrQYxQoBT0jd68h_9svBBUpzcllw8s5Cdxlo3TKHtMWWdpVHEr1hmrLehChJ1HCxovAfkR6oBBa6x_4hGQC3jycUGAJzZg8ZRi3Lh9CBEYI8fJ5zn5Axc3ZgsnqEjwW8FoeJx9sOjM1CzvUMfdKTDb_Y_p7woxdMZmO60zc4w-rQOI3A7NRAmQmMzOF3nzd2a6ynQzdbsU0qSUPNCCQwHzMae9gIppiwChm0Cbcw_iy3NJGY1VqkggRFeQDbc8eHpWJ_2YhibCYddocZ8yuIphet4yamF1R6Yq0Ie3zrwjChhs0EIGJy_RSWc3xDmRAwLVSRmr6_kgd2oqGNqdXEYdDihzOKE74poZOmhjnsuh5s3Sm8TOA1y1ja-2LRn5K8wEbZmXL1zzw3NgbIMve1ZcVKftrJ3frqhmYKXeLxDYBgs5oJhTcnXINclUKjYCIGGakM4Tu4P4sollB74htqyantuy_SOnCtpj-p474Y0Wj2qjCsP8JhdBPuEI3FHSVUxbNCg1LigKm_rWFgxy2zivBX3tD7ExSFOo7pSeo0w05jMCqoiU4-hmM5oj8l7drhhC3BnUfrGu0t8SJqhWM5itthZosQGBQO98hnwMsTh6dZeX-utJCL_P18igNIP3TRx4EGLzGZ4c5PqaH7Af6pvgdEapObsoigPlcJd-Eu0-2oqoeEPmCvtspCQRUKEfk8NB_k6bKxtd65IRxhk1Tauk92kyT0ZThwUiZ2S819GUHrP_4upcpbGmucDSX_tNnq8j-NBx1OBF79sb3N7L5ksRz6DzQspOf3KT4rhphkxptFf1O4eSiDGC_8Bhs56V-pl7iTrPRbnE7CpvaAiakbuQL2Q6hjbLz-p-0jtNPBioSQ1POvNegsO4yfL5PhvVQe5GOSelorysTXmf_VP2HWSlb-zogyZ030Trw09lvBZxJ2D9CAjjdVE_3pPW__z0u5zZ3YBNxOSVOTc90MmRPIyE2OVkqJKjMNviUd_eZUaWhWWRowFIeFSdqtPGMUi64TD4QIfNB6BqRIHbVcuoGQGRVRS0CzeucXlVoyC3GzHn8B5Q0TBO9isUT3VmSqJ1V4SDCOeKIkqidiyJlaIT7l0LoZpGHj8HHirjpEagY38pZCfUmyX0AtBoAVAHjAru1STHC1wOqoM6wcZjBaJz0sbEDB2GRoGqZPLIXyn0-EXFD5kpV-i7QBEk5aOX5m2ezZ9AXKq65Vs9Q0fSjLYywprJ8jVNyBtqsl6JDs8kkLXr_uJWEvxjNJizmM0MzlBuwgp_uJcwPl455_pO8dLd3e-937h5Wm6xi1USIcDchfmOL7b5sJ1GlRyC0dpVFH9--KEw0CgLyphBlxQ1IXTNhR47DSM-89acHfIQ8r1yXFrKo2vnotLk42oUn18Fa9mfpSZ4-g3dziNzqU0dcvcceV-fZt_wiC9g2i_Gi3pcimDvG8dL9QSU2FlAloR9R4es3uBi9CCgHQqGyl0CQm2JXyeb7TDhSlvzRpjRrzcaROYgnuY06zwxdMu0jPtAM96QFZqig9abol-JMgnp1NNMSb201VnmOXHI9i7_P4RisuBgTJ0CVMHzrYI6C6Hg5iLVZ2ec7RgiIr4N_p0nPoInaSHdMBvAAK0cIOpWvx3D86kBt7pMwH_q6Ek/wp/0.160045/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1ODMyNiZzaXRlSWQ9MTE2NTMzOCZhZElkPTU2MzUyNTkma2Fkc2l6ZWlkPTEwJnRsZElkPTAmY2FtcGFpZ25JZD0yMzAyNiZjcmVhdGl2ZUlkPTAmdWNyaWQ9MTc4MTgwODIzNTMyNjU5OTIyNzMmYWRTZXJ2ZXJJZD0yNDMmaW1waWQ9QUVFNTM3MUYtOTQwNC00RUNDLUEwQzgtODc2NTdBQ0VCQjMyJnBhc3NiYWNrPTA=_url=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44798d078224b9495181c7fa670e99acbc297f61637d5500810503a262c8a5fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 2262
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 04:08:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:08:56 GMT
last-modified: Tue, 29 Apr 2025 13:37:20 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 7404
x-xss-protection: 0
server: sffe

GET
H2 200 inside-1.js Show response
cdn.js7k.com/rq/iv/ Frame 05F2 42 KB
14 KB 241ms
57ms Script
application/javascript 2001:4998:60:807::1
YAHOO-CHA

General

Check archive.org

Download Go to

Full URL

https://cdn.js7k.com/rq/iv/inside-1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:60:807::1 , United States, ASN14196 (YAHOO-CHA, US),

Reverse DNS

Software

ATS /

Resource Hash

df202e5e498bc6a22593a307056a06c1364924dc09040ede6415ec9ca1a7bb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
etag: "31815d35f92ea8c948c5b8223229c0ce-df"
age: 232
date: Wed, 30 Apr 2025 03:42:47 GMT
last-modified: Mon, 09 Dec 2024 16:19:11 GMT
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-amz-id-2: 9+MVF6KBCI2/Y9Flqy6SDLODXj+/tRa+NoJDW8AMp54OsxToC9f9b/1kuBeGfppn72PhpTeuhfo=
strict-transport-security: max-age=31536000
cache-control: public,max-age=14400
referrer-policy: no-referrer-when-downgrade
x-amz-request-id: M41YRXZ4ADSTBAQB
accept-ranges: bytes
content-length: 14419
server: ATS
x-amz-server-side-encryption: AES256

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 4F80 0
920 B 25ms
25ms Script
text/html 68.67.181.211
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 99614262-e5bb-4d8b-96b7-613059a4a304
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 adchoicesblue.png
s.yimg.com/ch/icons/adchoices/ Frame 05F2 565 B
960 B 264ms
84ms Image
image/png 2001:4998:60:807::2
YAHOO-CHA

General

Check archive.org

Download Go to Show image

Full URL

https://s.yimg.com/ch/icons/adchoices/adchoicesblue.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:60:807::2 , United States, ASN14196 (YAHOO-CHA, US),

Reverse DNS

Software

ATS /

Resource Hash

b8954ed878ae615531f62b8d9a95a79d9a86a84f4af1504bcbec32d8e62d7ebd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "349bad1100a940608cb9109eb2b166a2"
x-amz-version-id: null
age: 16259
date: Tue, 29 Apr 2025 23:15:40 GMT
last-modified: Wed, 22 Jul 2020 18:15:42 GMT
vary: Origin
content-type: image/png
x-amz-id-2: X0R17JuYZwtgd0D25kzQ+vZ7h0to0n+3wZqOI7v1gM6M1o4ew6AEvSJkaq2EyCh6yMeQwgHsmXdnpIDo9KcAI87Ctvsr5+9k+Hei+rFWVDk=
strict-transport-security: max-age=31536000
cache-control: max-age=15552000, public
ats-carp-promotion: 1, 1
referrer-policy: no-referrer-when-downgrade
x-amz-request-id: DRDPY6TJVVJAAVX5
accept-ranges: bytes
content-length: 565
server: ATS
x-amz-server-side-encryption: AES256

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame C3E4 5 KB
2 KB 179ms
44ms Document
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 3357
apigw-requestid: J0G_ajHTPHcEPGQ=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 93840da1ee1241e1-EWR
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
last-modified: Wed, 30 Apr 2025 02:04:31 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame FEA1
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?us_privacy=pbs-ozone&gdpr=0&gdpr_consent=&s=189937&cb=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D0%26gdpr_consent%3D%26us_pr...
https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aBGdHUt3uT4AKjwSASs4PAAA%26039

0
273 B

52ms
52ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aBGdHUt3uT4AKjwSASs4PAAA%26039
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e&neustar.biz=E1:SXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE+jA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi+umoCvnoofCaZqUrz+V/9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5/aBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH+nD7+CKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy+wNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT+zy+eBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg/Dee/GStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4/RJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd+jaH6P2kaicD687Cd9iV199ubulUc++RU19IbSIkNxDhQxqoMHqTQh/blRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe+uwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF/Qg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM+q/ga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv+kjKtlE5NN/r/uNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z+RSreoRsIt9atVu3lGUpxhBagAbYQjkKJed/xCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ+M74QO+ueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw/mBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu+cq7tc+vVsrgrjvaXsRud26ChB81gQlHTebgaB3g6/l1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh+BDD3niCquFdu+BGIjUFio&liveintent.com=14-MNnwfLomvNAKAY2kpaLz2+J0i/jCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh+M13v3jzHPYNzWRYhi/s41FwfhpIafXTHg==&bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d&liveintent.triplelift.com=2735044350763865128379&media.net=3811953486957097000V10&rubiconproject.com=M99RJE97-17-9TYH&liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA&049&openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e&pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B&sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10&liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0&linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745984797777&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93840da0dc9e6991-PHL
expires: 0
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aBGdHUt3uT4AKjwSASs4PAAA%26039
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bVdSUAL%2BrAm1hB84x%2Bd9iIGY1n%2FtVwTkIrWYFtUC4kMbBw8pF%2BjciRMiwd%2F9NLlRDFAOr7%2FCmi5w15moS1vWRd3bQmFZdk0USWtpjG4VL%2BvL92VdgwxaRNdDtlVSZMIQFOfbpE4B"}],"group":"cf-nel","max_age":604800}
cf-ray: 93840da09a3641bb-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 03:46:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 122ms
115ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

b5fcbd3c2d78e0379b168199b32331223fae7c6592ede0d5ba27681d3cbc08c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

9.gif
id5-sync.com/c/483/429/0/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*4H8XS7t0HEAu0pW9v8henmBvxWmQ147NcjWPiMJ9GO0UCGimZ8bhS9c5x044rPG5&gdpr_consent=undefined&gdpr=false
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=91452127-6d77-454d-9678-41206a260217&ttl=%%TTL%%
https://ce.lijit.com/merge?pid=27&3pid=91452127-6d77-454d-9678-41206a260217&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1245%2F6%2F3.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://ce.lijit.com/merge?pid=27&3pid=91452127-6d77-454d-9678-41206a260217&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1245%2F6%2F3.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1245/6/3.gif?puid=KlKiARZHBHPuJA-ATsiywoxc&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F5%2F4.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/5/4.gif?puid=u_fead92af-bed1-458b-a435-4a10d4749bb3&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F4%2F5.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/4/5.gif?puid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F3%2F6.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/3/6.gif?puid=eb7e1059-2ab1-4d62-b770-82ed36af9fa2&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AAFLYE7QIzoAABvk5u-QTQ&id5AccountNum=155&numCascadesAllowed=9
https://ce.lijit.com/merge?pid=85&3pid=AAFLYE7QIzoAABvk5u-QTQ&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1241%2F1%2F8.gif%3Fpuid%3D%5BSOVRNID%5D%26gdpr%3D0%26g...
https://id5-sync.com/c/483/1241/1/8.gif?puid=KlKiALZHdGVXwmomRCaD6F1i&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F0%2F9.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/429/0/9.gif?puid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=

43 B
2 KB

112ms
111ms

Image
image/gif

141.95.33.120
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/c/483/429/0/9.gif?puid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

location: https://id5-sync.com/c/483/429/0/9.gif?puid=226852D5-3177-4DBD-A5A1-F8CFDAE877B1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/html; charset=UTF-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 49BF
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=91452127-6d77-454d-9678-41206a260217&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

48ms
47ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=91452127-6d77-454d-9678-41206a260217&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=91452127-6d77-454d-9678-41206a260217&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Wed, 30 Apr 2025 03:46:38 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 49BF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIB5M2ja3sIY2mcl40-zOi8&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
476 B

73ms
62ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIB5M2ja3sIY2mcl40-zOi8&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIB5M2ja3sIY2mcl40-zOi8&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 49BF
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0OTI0MTExMzUzMjk3NDMzOTk5Nw%3D%3D

170 B
188 B

46ms
44ms

Image
image/png

64.233.180.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0OTI0MTExMzUzMjk3NDMzOTk5Nw%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

64.233.180.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0OTI0MTExMzUzMjk3NDMzOTk5Nw%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 03:46:38 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 49BF
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDY0OTI0MTExMzUzMjk3NDMzOTk5Nw%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

69ms
67ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 49BF 0
248 B 220ms
103ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4649241113532974339997&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: E6ED81F3A2564BDBBD124F4005612A46 Ref B: PHL30EDGE0220 Ref C: 2025-04-30T03:46:39Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYz9sO6+vMuPJPoF5gbSw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT

GET
H2

200

sync
pippio.com/api/ Frame 49BF
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=4649241113532974339997
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=80b6b537-16f4-40e0-8fad-194cb3b10f5b
https://p.rfihub.com/cm?pub=39342&in=1&userid=058b32d7-3b20-4069-b1f7-a493186e8793%3A1745984799.1247206&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D058b32d7-3b20-4069...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=2809753635354192781&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D058b32...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=058b32d7-3b20-4069-b1f7-a493186e8793%3A1745984799.1247206&pid=500040&it=1&iv=058b32d7-3b20-4069-b1f7-a493186e8793%3A1745984799.1247206&_=174...
https://pippio.com/api/sync?it=1&pid=500040&_=1745984799.1263812&iv=058b32d7-3b20-4069-b1f7-a493186e8793:1745984799.1247206

42 B
344 B

169ms
90ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1745984799.1263812&iv=058b32d7-3b20-4069-b1f7-a493186e8793:1745984799.1247206
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1745984799.1263812&iv=058b32d7-3b20-4069-b1f7-a493186e8793:1745984799.1247206
Content-Length: 0
Date: Wed, 30 Apr 2025 03:46:39 GMT
trace-id: c414b8f8ac319939
Request-Time: 1
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 49BF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/4649241113532974339997?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-ddPwmVFE2oTDNOa0c.inSp_.UwCls9iZ0wOvjAI9OA--~A&dongle=0883

37 B
476 B

72ms
62ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-ddPwmVFE2oTDNOa0c.inSp_.UwCls9iZ0wOvjAI9OA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-ddPwmVFE2oTDNOa0c.inSp_.UwCls9iZ0wOvjAI9OA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 49BF 42 B
691 B 191ms
62ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=4649241113532974339997&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "15235cb149b5db1:0"
x-msedge-ref: Ref A: 4E62351C5C7D418F9C19EBBBC8F93B60 Ref B: PHL30EDGE0217 Ref C: 2025-04-30T03:46:39Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
last-modified: Thu, 24 Apr 2025 18:50:05 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 49BF
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=6c9414133171087&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHlV_JbbfRmwJK26XhAQEBAQEBAQCXhczAzAEBAQEBAQEB&expiration=1746071199&is_secure=true&gdpr_consent=&gdpr=0

37 B
476 B

31ms
29ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHlV_JbbfRmwJK26XhAQEBAQEBAQCXhczAzAEBAQEBAQEB&expiration=1746071199&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHlV_JbbfRmwJK26XhAQEBAQEBAQCXhczAzAEBAQEBAQEB&expiration=1746071199&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 49BF
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-99a8b9d0-6b64-551e-4970-32f4772efa15$ip$206.66.99.36&dongle=4430

37 B
476 B

30ms
30ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-99a8b9d0-6b64-551e-4970-32f4772efa15$ip$206.66.99.36&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-99a8b9d0-6b64-551e-4970-32f4772efa15$ip$206.66.99.36&dongle=4430
Content-Length: 138
Date: Wed, 30 Apr 2025 03:46:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame FEA1
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://elb.the-ozone-project.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=7646926639373327599

0
361 B

65ms
56ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=7646926639373327599
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e&neustar.biz=E1:SXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE+jA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi+umoCvnoofCaZqUrz+V/9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5/aBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH+nD7+CKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy+wNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT+zy+eBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg/Dee/GStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4/RJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd+jaH6P2kaicD687Cd9iV199ubulUc++RU19IbSIkNxDhQxqoMHqTQh/blRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe+uwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF/Qg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM+q/ga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv+kjKtlE5NN/r/uNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z+RSreoRsIt9atVu3lGUpxhBagAbYQjkKJed/xCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ+M74QO+ueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw/mBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu+cq7tc+vVsrgrjvaXsRud26ChB81gQlHTebgaB3g6/l1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh+BDD3niCquFdu+BGIjUFio&liveintent.com=14-MNnwfLomvNAKAY2kpaLz2+J0i/jCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh+M13v3jzHPYNzWRYhi/s41FwfhpIafXTHg==&bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d&liveintent.triplelift.com=2735044350763865128379&media.net=3811953486957097000V10&rubiconproject.com=M99RJE97-17-9TYH&liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA&049&openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e&pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B&sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10&liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0&linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745984797777&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93840da17d496991-PHL
expires: 0
content-length: 0
date: Wed, 30 Apr 2025 03:46:38 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://elb.the-ozone-project.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=7646926639373327599
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 49c90f12-6c3f-4121-9dc6-9bd3df6c00c6
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:38 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 28C6 44 KB
11 KB 78ms
68ms Script
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 8def8d0d480896d5713d17bfe7561ce293eb12921307face99f6ddf548cf9c2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=15357
content-encoding: gzip
expires: Wed, 30 Apr 2025 08:02:35 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Wed, 30 Apr 2025 03:46:38 GMT
last-modified: Tue, 29 Apr 2025 08:03:30 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 impl_v105.js Show response
www.googletagservices.com/dcm/ Frame 05F2 68 KB
26 KB 34ms
33ms Script
text/javascript 2607:f8b0:4004:c07::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v105.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb6988f24a0e19064f2ac7189c4f31560dbe71def169241a739a812d9f72f50a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 150078
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Tue, 28 Apr 2026 10:05:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 28 Apr 2025 10:05:20 GMT
last-modified: Mon, 10 Mar 2025 13:27:01 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 26462
x-xss-protection: 0
server: sffe

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 5B4B
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

269 B
379 B

36ms
35ms

Document
text/html

23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
server: AkamaiGHost

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 852 B
1 KB 254ms
252ms Fetch
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

bab25b65b968d3c146603f249f44925b8a88c9a61f20e359719b5ae9e759514d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/json
vary: Origin

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 519A 4 KB
5 KB 210ms
42ms Document
text/html 44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=&gpp=&gpp_sid=&pubcid.org=fd346f8b-e7f6-4933-8db4-6312cb36b66e&neustar.biz=E1:SXVKf3tyNZCmbzPuEgH879w-a-3d8r6Yo85ss9mL1Pv2VhlGyAht1ZKAWRxxCkCpaPDcHL6hnHovlqyPVUagc2Z_XnxspY72yjHWTiTQktGtRfJeN90DjO4_eTyQuPVj&33across.com=v1.0014000001YrMoYAAV.1041.RWcV8lC7cMeWgZr9Ni8ivzzzSKX03hpGK0GC0757gDFw8bKVYdnLpKKPpn5Xr5SIkVS0FLewl1Uc3E6hPoSlzbhJ4GNE+jA94YguRF3TjHRRoBOu8smB1y4EBehD1XhreSSqBl33ebzUMVqgK1Hw7EgEPETcWAkhEFfi+umoCvnoofCaZqUrz+V/9T6rkBBOBiPUbffioGZSqkQQBENw1MVHmN5HudDT1f0wAJcN9EqLOYQsGaSFIejE2vzRJAIxCZCtn0Xst1CJVmMcnckunrI2nLynzls8oVtiJDYQtyXwqgcQO83BhOVS8T5/aBRCQmVFEViPSB8SmV4dRj61ElM5CFooozBhSoSIEFagMqkfH+nD7+CKP2NhnwFq6Q2aIs2AXR0we2vPMkOiTBdCoNYne0IToXs9FX6Y8fd73z3puVVPmTBy+wNZgVrzIUPHwklK6ugTYbKyAq00fSJF3aaVIPvNZ46ufyxPVDAEh8OoOv14sSoJifNEIDDyRsgxl60FHT+zy+eBvBFIS6ab3TxQTqmEiXyToGTNOKDblk6k7bdeR0HAxbkeQKEceOWVFZJCqvZoCKbzTscNQ8qg/Dee/GStLI9l5MOPI2rFOaQ3cqh0hUYSSOkiHZUX4asecU5CZsj4/RJ0u23e5JijiUmr1jGyIM88xTMERD178KV4t7oiZRILEn0ygd+jaH6P2kaicD687Cd9iV199ubulUc++RU19IbSIkNxDhQxqoMHqTQh/blRY5xzwNbTMIfYsIvYzUcHceFMZU9YgN034ze4BJ5phXUvZW7dYz3URLsLmEsywB9sRtEPS1yvTyPFjgNNXgKwfZOuhaBeDIxtlJy3kIfHMuIcd1h5nDe+uwfG4zd5j7qdUezY2MAH6TsOLWcE0zymZ6H890JRG0oJFCNqcuOWxHIbmK89MFK2PjFY0YDld43QBVfjpTFWF/Qg5w1jJKoC9jhD5Sp9bZ57ebUv7ZuMk7Wze9AlqYl3rM+q/ga0YRClkyCXBGrEvkWF4Kgo1A0rvcgCN6fP3kLvf3KdlfpXPZeUsSG16kvNIad7YGS8DunSWCAJc54xYcDrLLq4v0nakV9lBmNCCPrv+kjKtlE5NN/r/uNecRTSEdCrTPxbiAO3KeBQSJQiV1FG33B3UT4fjOtMQ6z+RSreoRsIt9atVu3lGUpxhBagAbYQjkKJed/xCPNZmGSctMddJqPdBBArqZAkWIWqyFI50G9aK4S251knLbEJytRt7S9N0YQw3YTHTRPf5cBJVK1fDdTatoDfDzsCFKOTnT9ZhMT0jhAl5kLAYiSsZLG3zQWSmkvidqZ+M74QO+ueDDTd5OPPY83NrCdzOgHcyk24BME9qhTenyMt4z1Ern8870McpOwMPRSUjw/mBs3XGbqXBx6jDKWPsQmAx8eVb8Dzu+cq7tc+vVsrgrjvaXsRud26ChB81gQlHTebgaB3g6/l1u6Pze1fxZCYetDiDk3JHKJtOPmLAX0tjEqPYfdqyh+BDD3niCquFdu+BGIjUFio&liveintent.com=14-MNnwfLomvNAKAY2kpaLz2+J0i/jCsdmnaff0NQ0dFT75AskEDtwSnwIrwYaFAha7QqE49UG8N4Yh+M13v3jzHPYNzWRYhi/s41FwfhpIafXTHg==&bidswitch.net=94ba8038-cb95-4b3b-b5ce-2fe6827f3a8d&liveintent.triplelift.com=2735044350763865128379&media.net=3811953486957097000V10&rubiconproject.com=M99RJE97-17-9TYH&liveintent.indexexchange.com=ZvOHltHM7yEAAF.vAB2wegAA&049&openx.net=66b34471-1074-4fa0-b9ba-39c4f774724e&pubmatic.com=8BC711CF-EB2D-43C7-94CE-EB501467682B&sharethrough.com=4d1e1e76-340a-43c5-88c9-586abfa68e10&liveintent.sonobi.com=de4bfa41-9b5d-4eff-9d43-4fa440f447b0&linkedin.com=a7c67af2-0cbb-4535-aeed-1d7852c0edf7&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745984797777&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: daf486f31865cd7f2c3eff8c5bb3d9aa85063644c98c048b7a87ddfb3f46275e

Request headers

Referer: https://elb.the-ozone-project.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://elb.the-ozone-project.com/
access-control-expose-headers: X-Reason
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
server: istio-envoy
x-envoy-upstream-service-time: 4

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame DB90 44 KB
16 KB 27ms
25ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6758e303ab9f99541c823260f6f9c9356d8044357926cb2960ae563375a59a0a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=53317
content-encoding: gzip
content-length: 15624
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
expires: Wed, 30 Apr 2025 18:35:16 GMT
last-modified: Wed, 13 Nov 2024 05:15:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 AdDisplayTrackerServlet Show response
st.pubmatic.com/AdServer/ Frame 6933 0
91 B 246ms
40ms Document
text/plain 8.28.7.95
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://st.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=158326&siteId=1165338&adId=5635259&imprId=AEE5371F-9404-4ECC-A0C8-87657ACEBB32&cksum=130E9CCB88DA5D5B&adType=10&adServerId=243&kefact=0.139575&kaxefact=0.139575&kadNetFrequecy=0&kadwidth=160&kadheight=600&kadsizeid=10&kltstamp=1745984797&indirectAdId=0&adServerOptimizerId=2&ranreq=0.1&kpbmtpfact=0.160045&dcId=2&tldId=0&passback=0&svr=BIDNJE10759&adsver=_1429821247&adsabzcid=0&cls=BID&i0=0x3100000000000000&ekefact=HZ0RaE1-BwCAEga6-AibsBTGBhrfyF5BRk-0KknrbZvrId5t&ekaxefact=HZ0RaFR-BwBmicdMC4N-x9pCA1zinRhZuWv25Xduqr9DIT1W&ekpbmtpfact=HZ0RaFx-BwBQiyjnjdVKAEdIkrU1XxYOepAgx03xMYIqCX_7&enpp=HZ0RaGN-BwDbsJkVxK7JWbrPBggAKtnUpO-LJ1D1zHZ0bMeX&pmr_m=HZ0RaGh-BwA_wRKmESZLV_avAGAmllv7nrRRHyXikS1LXZgz&mdsp=HZ0RaG1-BwDg19yZfOJGYY03DL8on2RtU8hLLbkvX19ovu9Z&pfi=1&domId=12914365086030784464&dc=NJE1&cpd=3&cpid=8BC711CF-EB2D-43C7-94CE-EB501467682B&pubBuyId=28603&crID=7572671&lpu=universalorlando.com&ucrid=17818082353265992273&wAdType=10&campaignId=23026&creativeId=0&pctr=0.000000&wDSPByrId=921&wDspId=452&wbId=2&wrId=0&wAdvID=506&wDspCampId=3410790&isRTB=1&rtbId=821ABE8B-8ED4-4DEF-A0C6-D7530762D5A8B&burl=https%3A%2F%2Fpn.ybp.yahoo.com%2Fbw%2Fpubmatic%2Fimp%2F04f3LwizdEAsZEqZ0samYMq8NTqsUBkohmb3_NscFkLJmCdjDJ6Q_ginLQyLHcwGXFWtRdqEAZ-L0EVxTGz2SKCS1ncles1dUDRWfhuc-_WeobAQBntg8qYyNXaNAaCgnNc9D5C3FG07pQGq1n8cyIBCd6ZrWM8xjAAzxAYfgCRuKbik0zPulRDp3Ol6QhGhjcvNTV9Fx9V_ga8OfHZhktJ-bupuFi-v34unesIHzw-YG0P9F92lRzgj76y60w10sEb3UfArCjVukB7HRRe3NE9x3rNrs_mxET3IVkjLxhVtad4k9aQtjFePHnwwlQmmvvhcz61izY1r_Zh0tpfaCjywiNm5Z4G84qiZmydh7zgQKaccZwR9r0sMci_nBGscuYs5NG1d782dAOU6639P6EnrYKIBEF2QJ0NA_Av2GEEQfUYvQNoLM1WMzaS4UMV1BLf7t-l1d6G8HQrjdywcEcvrQYxQoBT0jd68h_9svBBUpzcllw8s5Cdxlo3TKHtMWWdpVHEr1hmrLehChJ1HCxovAfkR6oBBa6x_4hGQC3jycUGAJzZg8ZRi3Lh9CBEYI8fJ5zn5Axc3ZgsnqEjwW8FoeJx9sOjM1CzvUMfdKTDb_Y_p7woxdMZmO60zc4w-rQOI3A7NRAmQmMzOF3nzd2a6ynQzdbsU0qSUPNCCQwHzMae9gIppiwChm0Cbcw_iy3NJGY1VqkggRFeQDbc8eHpWJ_2YhibCYddocZ8yuIphet4yamF1R6Yq0Ie3zrwjChhs0EIGJy_RSWc3xDmRAwLVSRmr6_kgd2oqGNqdXEYdDihzOKE74poZOmhjnsuh5s3Sm8TOA1y1ja-2LRn5K8wEbZmXL1zzw3NgbIMve1ZcVKftrJ3frqhmYKXeLxDYBgs5oJhTcnXINclUKjYCIGGakM4Tu4P4sollB74htqyantuy_SOnCtpj-p474Y0Wj2qjCsP8JhdBPuEI3FHSVUxbNCg1LigKm_rWFgxy2zivBX3tD7ExSFOo7pSeo0w05jMCqoiU4-hmM5oj8l7drhhC3BnUfrGu0t8SJqhWM5itthZosQGBQO98hnwMsTh6dZeX-utJCL_P18igNIP3TRx4EGLzGZ4c5PqaH7Af6pvgdEapObsoigPlcJd-Eu0-2oqoeEPmCvtspCQRUKEfk8NB_k6bKxtd65IRxhk1Tauk92kyT0ZThwUiZ2S819GUHrP_4upcpbGmucDSX_tNnq8j-NBx1OBF79sb3N7L5ksRz6DzQspOf3KT4rhphkxptFf1O4eSiDGC_8Bhs56V-pl7iTrPRbnE7CpvaAiakbuQL2Q6hjbLz-p-0jtNPBioSQ1POvNegsO4yfL5PhvVQe5GOSelorysTXmf_VP2HWSlb-zogyZ030Trw09lvBZxJ2D9CAjjdVE_3pPW__z0u5zZ3YBNxOSVOTc90MmRPIyE2OVkqJKjMNviUd_eZUaWhWWRowFIeFSdqtPGMUi64TD4QIfNB6BqRIHbVcuoGQGRVRS0CzeucXlVoyC3GzHn8B5Q0TBO9isUT3VmSqJ1V4SDCOeKIkqidiyJlaIT7l0LoZpGHj8HHirjpEagY38pZCfUmyX0AtBoAVAHjAru1STHC1wOqoM6wcZjBaJz0sbEDB2GRoGqZPLIXyn0-EXFD5kpV-i7QBEk5aOX5m2ezZ9AXKq65Vs9Q0fSjLYywprJ8jVNyBtqsl6JDs8kkLXr_uJWEvxjNJizmM0MzlBuwgp_uJcwPl455_pO8dLd3e-937h5Wm6xi1USIcDchfmOL7b5sJ1GlRyC0dpVFH9--KEw0CgLyphBlxQ1IXTNhR47DSM-89acHfIQ8r1yXFrKo2vnotLk42oUn18Fa9mfpSZ4-g3dziNzqU0dcvcceV-fZt_wiC9g2i_Gi3pcimDvG8dL9QSU2FlAloR9R4es3uBi9CCgHQqGyl0CQm2JXyeb7TDhSlvzRpjRrzcaROYgnuY06zwxdMu0jPtAM96QFZqig9abol-JMgnp1NNMSb201VnmOXHI9i7_P4RisuBgTJ0CVMHzrYI6C6Hg5iLVZ2ec7RgiIr4N_p0nPoInaSHdMBvAAK0cIOpWvx3D86kBt7pMwH_q6Ek%2Fai%2F821ABE8B-8ED4-4DEF-A0C6-D7530762D5A8B%2Fwp%2F0.160045&ver=27&dateHr=2025043003&usrgen=0&usryob=0&layeringebl=1&usrip=2600:803:a88:3036::36&gctry=us&greg=ny&uid=1&mid=0&wccookied=0&wcrnk=-1&qpsladszid=10&eburl=aHR0cHM6Ly9wbi55YnAueWFob28uY29tL2J3L3B1Ym1hdGljL2ltcC8wNGYzTHdpemRFQXNaRXFaMHNhbVlNcThOVHFzVUJrb2htYjNfTnNjRmtMSm1DZGpESjZRX2dpbkxReUxIY3dHWEZXdFJkcUVBWi1MMEVWeFRHejJTS0NTMW5jbGVzMWRVRFJXZmh1Yy1fV2VvYkFRQm50ZzhxWXlOWGFOQWFDZ25OYzlENUMzRkcwN3BRR3ExbjhjeUlCQ2Q2WnJXTTh4akFBenhBWWZnQ1J1S2JpazB6UHVsUkRwM09sNlFoR2hqY3ZOVFY5Rng5Vl9nYThPZkhaaGt0Si1idXB1RmktdjM0dW5lc0lIenctWUcwUDlGOTJsUnpnajc2eTYwdzEwc0ViM1VmQXJDalZ1a0I3SFJSZTNORTl4M3JOcnNfbXhFVDNJVmtqTHhoVnRhZDRrOWFRdGpGZVBIbnd3bFFtbXZ2aGN6NjFpelkxcl9aaDB0cGZhQ2p5d2lObTVaNEc4NHFpWm15ZGg3emdRS2FjY1p3UjlyMHNNY2lfbkJHc2N1WXM1TkcxZDc4MmRBT1U2NjM5UDZFbnJZS0lCRUYyUUowTkFfQXYyR0VFUWZVWXZRTm9MTTFXTXphUzRVTVYxQkxmN3QtbDFkNkc4SFFyamR5d2NFY3ZyUVl4UW9CVDBqZDY4aF85c3ZCQlVwemNsbHc4czVDZHhsbzNUS0h0TVdXZHBWSEVyMWhtckxlaENoSjFIQ3hvdkFma1I2b0JCYTZ4XzRoR1FDM2p5Y1VHQUp6Wmc4WlJpM0xoOUNCRVlJOGZKNXpuNUF4YzNaZ3NucUVqd1c4Rm9lSng5c09qTTFDenZVTWZkS1REYl9ZX3A3d294ZE1abU82MHpjNHctclFPSTNBN05SQW1RbU16T0YzbnpkMmE2eW5RemRic1UwcVNVUE5DQ1F3SHpNYWU5Z0lwcGl3Q2htMENiY3dfaXkzTkpHWTFWcWtnZ1JGZVFEYmM4ZUhwV0pfMlloaWJDWWRkb2NaOHl1SXBoZXQ0eWFtRjFSNllxMEllM3pyd2pDaGhzMEVJR0p5X1JTV2MzeERtUkF3TFZTUm1yNl9rZ2Qyb3FHTnFkWEVZZERpaHpPS0U3NHBvWk9taGpuc3VoNXMzU204VE9BMXkxamEtMkxSbjVLOHdFYlptWEwxenp3M05nYklNdmUxWmNWS2Z0ckozZnJxaG1ZS1hlTHhEWUJnczVvSmhUY25YSU5jbFVLallDSUdHYWtNNFR1NFA0c29sbEI3NGh0cXlhbnR1eV9TT25DdHBqLXA0NzRZMFdqMnFqQ3NQOEpoZEJQdUVJM0ZIU1ZVeGJOQ2cxTGlnS21fcldGZ3h5MnppdkJYM3REN0V4U0ZPbzdwU2VvMHcwNWpNQ3FvaVU0LWhtTTVvajhsN2RyaGhDM0JuVWZyR3UwdDhTSnFoV001aXR0aFpvc1FHQlFPOThobndNc1RoNmRaZVgtdXRKQ0xfUDE4aWdOSVAzVFJ4NEVHTHpHWjRjNVBxYUg3QWY2cHZnZEVhcE9ic29pZ1BsY0pkLUV1MC0yb3FvZUVQbUN2dHNwQ1FSVUtFZms4TkJfazZiS3h0ZDY1SVJ4aGsxVGF1azkya3lUMFpUaHdVaVoyUzgxOUdVSHJQXzR1cGNwYkdtdWNEU1hfdE5ucThqLU5CeDFPQkY3OXNiM043TDVrc1J6NkR6UXNwT2YzS1Q0cmhwaGt4cHRGZjFPNGVTaURHQ184QmhzNTZWLXBsN2lUclBSYm5FN0NwdmFBaWFrYnVRTDJRNmhqYkx6LXAtMGp0TlBCaW9TUTFQT3ZOZWdzTzR5Zkw1UGh2VlFlNUdPU2Vsb3J5c1RYbWZfVlAySFdTbGItem9neVowMzBUcncwOWx2Qlp4SjJEOUNBampkVkVfM3BQV19fejB1NXpaM1lCTnhPU1ZPVGM5ME1tUlBJeUUyT1ZrcUpLak1OdmlVZF9lWlVhV2hXV1Jvd0ZJZUZTZHF0UEdNVWk2NFRENFFJZk5CNkJxUklIYlZjdW9HUUdSVlJTMEN6ZXVjWGxWb3lDM0d6SG44QjVRMFRCTzlpc1VUM1ZtU3FKMVY0U0RDT2VLSWtxaWRpeUpsYUlUN2wwTG9acEdIajhISGlyanBFYWdZMzhwWkNmVW15WDBBdEJvQVZBSGpBcnUxU1RIQzF3T3FvTTZ3Y1pqQmFKejBzYkVEQjJHUm9HcVpQTElYeW4wLUVYRkQ1a3BWLWk3UUJFazVhT1g1bTJlelo5QVhLcTY1VnM5UTBmU2pMWXl3cHJKOGpWTnlCdHFzbDZKRHM4a2tMWHJfdUpXRXZ4ak5KaXptTTBNemxCdXdncF91SmN3UGw0NTVfcE84ZExkM2UtOTM3aDVXbTZ4aTFVU0ljRGNoZm1PTDdiNXNKMUdsUnlDMGRwVkZIOS0tS0V3MENnTHlwaEJseFExSVhUTmhSNDdEU00tODlhY0hmSVE4cjF5WEZyS28ydm5vdExrNDJvVW4xOEZhOW1mcFNaNC1nM2R6aU56cVUwZGN2Y2NlVi1mWnRfd2lDOWcyaV9HaTNwY2ltRHZHOGRMOVFTVTJGbEFsb1I5UjRlczN1Qmk5Q0NnSFFxR3lsMENRbTJKWHllYjdURGhTbHZ6UnBqUnJ6Y2FST1lnbnVZMDZ6d3hkTXUwalB0QU05NlFGWnFpZzlhYm9sLUpNZ25wMU5OTVNiMjAxVm5tT1hISTlpN19QNFJpc3VCZ1RKMENWTUh6cllJNkM2SGc1aUxWWjJlYzdSZ2lJcjROX3AwblBvSW5hU0hkTUJ2QUFLMGNJT3BXdngzRDg2a0J0N3BNd0hfcTZFay9haS84MjFBQkU4Qi04RUQ0LTRERUYtQTBDNi1ENzUzMDc2MkQ1QThCL3dwLzAuMTYwMDQ1&oid=AEE5371F-9404-4ECC-A0C8-87657ACEBB32&cntryId=232&domain=paint.toys&sec=1&pAuSt=3&wops=3&sURL=paint.toys&BrID=5&ulxnab=2&te=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.95 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
expires: 0
pragma: no-cache

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05F2 0
0 82ms
81ms Fetch
image/gif 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05F2 0
0 70ms
70ms Fetch
image/gif 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05F2 0
0 39ms
38ms Fetch
image/gif 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 05F2 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c42df1f063a57aa9c973ec47f25ce346976307b7a6b37f7914f3e12e8130cf72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 39ms
39ms Fetch
text/html 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504240101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 5B4B 44 KB
0 78ms
68ms Script
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 8def8d0d480896d5713d17bfe7561ce293eb12921307face99f6ddf548cf9c2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

Response headers

cache-control: max-age=15357
content-encoding: gzip
expires: Wed, 30 Apr 2025 08:02:35 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Wed, 30 Apr 2025 03:46:38 GMT
last-modified: Tue, 29 Apr 2025 08:03:30 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
35 B 184ms
182ms XHR
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 93840da4f88b557d-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:39 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 225ms
139ms Preflight
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 93840da42f17557d-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 03:46:39 GMT
server: cloudflare
vary: Origin

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings
https://cs.yellowblue.io/cs?aid=11599&id=OPTOUT

0
354 B

30ms
30ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11599&id=OPTOUT
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11599&id=OPTOUT
date: Wed, 30 Apr 2025 03:46:39 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11606%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=3935146244966098880

0
354 B

32ms
31ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=3935146244966098880
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

access-control-max-age: 86400
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=3935146244966098880
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://ads.yieldmo.com/pbsync?gdpr=0&gdpr_consent=&is=rise&redirectUri=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11584%26uid%3D%24UID&us_privacy=
https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xcL1cwwlL1wmTepj5m06&gdpr=0&gdpr_consent=&us_privacy=

0
354 B

77ms
73ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xcL1cwwlL1wmTepj5m06&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xcL1cwwlL1wmTepj5m06&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://csync.loopme.me/?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D
https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=2505349d-5e3e-448a-8d0e-28ff325ccdf1&gdpr_consent=null&gdpr=0

0
354 B

49ms
49ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=2505349d-5e3e-448a-8d0e-28ff325ccdf1&gdpr_consent=null&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=2505349d-5e3e-448a-8d0e-28ff325ccdf1&gdpr_consent=null&gdpr=0
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: _

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=77&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11600&id=2205788714523894302&gdpr=0&gdpr_consent=

0
354 B

72ms
28ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11600&id=2205788714523894302&gdpr=0&gdpr_consent=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

date: Wed, 30 Apr 2025 03:46:39 GMT
location: https://cs.yellowblue.io/cs?aid=11600&id=2205788714523894302&gdpr=0&gdpr_consent=
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a

0
354 B

74ms
71ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:39 GMT

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://creativecdn.com/cm-notify?pi=rise
https://creativecdn.com/cm-notify?pi=rise&tc=1
https://cs.yellowblue.io/cs?aid=11610&id=IJZH-jr-kWVEQaQXC41y0W8RzySi1aviej-dMpYD8uA&pi=rise&tc=1

0
354 B

45ms
45ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11610&id=IJZH-jr-kWVEQaQXC41y0W8RzySi1aviej-dMpYD8uA&pi=rise&tc=1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://cs.yellowblue.io/cs?aid=11610&id=IJZH-jr-kWVEQaQXC41y0W8RzySi1aviej-dMpYD8uA&pi=rise&tc=1
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT, Wed, 30 Apr 2025 03:46:39 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

503

sync
sync.inmobi.com/ Frame 519A
Redirect Chain

https://sync.inmobi.com/oRTB?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=

81 B
81 B

59ms
56ms

Image
text/plain

35.212.31.229
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 35.212.31.229 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 229.31.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e072b8ccba034ba778fc1c520028bb9d0f8158420882f274825d12c7bb3b2cc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:39 GMT
x-envoy-overloaded: true
content-type: text/plain
vary: Accept-Encoding
server: envoy

Redirect headers

location: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
x-envoy-upstream-service-time: 252
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: envoy

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=rise&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11574%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=ffd8c0e5b9

0
354 B

54ms
54ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=ffd8c0e5b9
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=ffd8c0e5b9
content-length: 5
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/plain; charset=utf-8

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://visitor-risecode.omnitagjs.com/visitor/bsync?name=risecode&uid=40a3c28f9ffc73ee86df2bac2d2bb390&url=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26fwrd%3D1%26aid%3D11609%26id%3D%5BBUYER_I...
https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=4489e86ad97f9e0ba4d91febf8f6e1eb

0
354 B

56ms
56ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=4489e86ad97f9e0ba4d91febf8f6e1eb
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=4489e86ad97f9e0ba4d91febf8f6e1eb
x-kong-request-id: 9414e1043c391e6d2f3cec43b00a8c34
via: kong/3.6.1
x-kong-upstream-latency: 2
x-kong-proxy-latency: 1
content-length: 0
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/html; charset=UTF-8
server: fasthttp

GET
H2

204

match
ssp-sync.criteo.com/user-sync/ Frame 519A
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?gdpr=0&gdpr_consent=&profile=342&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11614%26id%3D%24%7BCRITEO_USER_ID%7D
https://x.bidswitch.net/sync?ssp=criteo&custom_data=TkOF718yejBMaCUyQmlWcUxhelJUcTglMkY2VjFCbEVkRkt2MUNPajJxYVklMkY5SkFDa1dxNjg5Q1NGdE04S0N0Q1E1JTJCZWQlMkIyeWYxWG80WjJQaWlhYUl3VnZSUU5OWE9CQXIxM3cwS...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a&ssp=criteo&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10609565930862161014&ssp=criteo&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10609565930862161014&ssp=criteo&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=criteo
https://x.bidswitch.net/sync?dsp_id=419&user_id=10609565930862161014&ssp=criteo&gdpr=&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=&u=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a

0
141 B

28ms
27ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=&u=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a

Requested by

Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Wed, 30 Apr 2025 03:46:39 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //ssp-sync.criteo.com/user-sync/match?p=&u=1de82d98-29b4-4bf1-b60c-54d6f7d9a14a
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 03:46:40 GMT

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11580%26puid%3D33XUSERID33X
https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=212791501972607

0
354 B

37ms
36ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=212791501972607
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=212791501972607
pragma: no-cache
referrer-policy: unsafe-url
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: 33XP019

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://bh.contextweb.com/bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=YGkAze12Nm1h&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0

0
354 B

29ms
25ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=YGkAze12Nm1h&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=YGkAze12Nm1h&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-cc58c7bc8-7mr55
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-US
server: Jetty(12.0.17)

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=763f5531-000e-4125-8b3e-7b07debc5fe6-68119d1f-5553&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=
https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=226852D5-3177-4DBD-A5A1-F8CFDAE877B1

0
354 B

43ms
42ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=226852D5-3177-4DBD-A5A1-F8CFDAE877B1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=226852D5-3177-4DBD-A5A1-F8CFDAE877B1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 115
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://match.sharethrough.com/universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422
https://cs.yellowblue.io/cs?aid=11587&uid=3c371061-281f-40c8-ae23-2a75c8e21086&gdpr=0

0
354 B

33ms
32ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=3c371061-281f-40c8-ae23-2a75c8e21086&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cs.yellowblue.io/cs?aid=11587&uid=3c371061-281f-40c8-ae23-2a75c8e21086&gdpr=0
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://us-u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=58ceaaf5-c766-4c17-869a-d76e43401714&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26id%3D
https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=f81d9c15-4be7-49aa-8cc1-bbd9684f8c7b

0
354 B

80ms
39ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=f81d9c15-4be7-49aa-8cc1-bbd9684f8c7b
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=f81d9c15-4be7-49aa-8cc1-bbd9684f8c7b
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://ads.stickyadstv.com/user-matching?gdpr=0&gdpr_consent=&id=3663
https://cs.yellowblue.io/cs?aid=11601&id=48cd6f5df539adfa6e7cd7e59576ce&gdpr_consent=&gdpr=0

0
354 B

49ms
48ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=48cd6f5df539adfa6e7cd7e59576ce&gdpr_consent=&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache
Location: https://cs.yellowblue.io/cs?aid=11601&id=48cd6f5df539adfa6e7cd7e59576ce&gdpr_consent=&gdpr=0
Pragma: no-cache
x-sticky-vk: 1745984799974003-141
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Wed, 30 Apr 2025 03:46:39 GMT
Server: nginx

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://contextual.media.net/cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3C...
https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3889864005725201000V10

0
354 B

70ms
70ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3889864005725201000V10
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3889864005725201000V10
timing-allow-origin: *
pragma: no-cache
expires: Wed, 30 Apr 2025 03:46:40 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
content-length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: text/html
server: Apache

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=7646926639373327599

0
354 B

90ms
44ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=7646926639373327599
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=7646926639373327599
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: c93c9f3c-06c1-4536-bedb-4719b049ff1d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

cs
cs.yellowblue.io/ Frame 519A
Redirect Chain

https://sync.go.sonobi.com/us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d

0
354 B

38ms
38ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-cache, no-store, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 30 Apr 2025 03:46:40 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-187
x-xss-protection: 0

GET
H2 200 setuid
elb.the-ozone-project.com/ Frame 519A 0
461 B 56ms
53ms Image
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=rise&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=YhGj4f59CH
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 93840da40fe66991-PHL
expires: 0
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 5697 953 B
1 KB 34ms
33ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: faaa1b75ab16b96573c37246d02d7339fab43c81d1e243b41ca8a9ee45858fe9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 953
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.36

POST
H2 204 event
p.ad.gt/api/v1/ Frame C3E4 0
140 B 258ms
167ms Ping
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 93840da5cc07421d-EWR
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 03:46:39 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 227ms
134ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 93840da45ef10cb8-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 03:46:39 GMT
server: cloudflare
vary: Origin

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 713C 2 KB
1003 B 961ms
416ms Document
text/html 51.222.39.185
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.185 , Canada, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ip185.ip-51-222-39.net

Software

Resource Hash

d6b9ac8ccff69f2de32254b96a2bb180535f809c2d8059d40be5844a8cbad026

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 870
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 807B
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage
https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

269 B
379 B

184ms
182ms

Document
text/html

23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
location: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
server: AkamaiGHost

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 2349
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KlKiALZHdGVXwmomRCaD6F1i

0
354 B

33ms
32ms

Document
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KlKiALZHdGVXwmomRCaD6F1i
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Wed, 30 Apr 2025 03:46:39 GMT
server: istio-envoy
x-envoy-upstream-service-time: 4

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=KlKiALZHdGVXwmomRCaD6F1i
vary: Accept-Encoding

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 3337
Redirect Chain

https://ssp.disqus.com/redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716
https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119

0
354 B

44ms
44ms

Document
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirect=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D[PBS_UID]
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Wed, 30 Apr 2025 03:46:39 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0

Redirect headers

cache-control: no-store
content-length: 0
expires: 0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
pragma: no-cache

GET
H3 200 setuid
prebid.intergient.com/ Frame 5697 0
714 B 45ms
43ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=29c30f4c-2597-4706-ac0a-275ec8bd9ab5

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93840da42ee7a67e-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/html
vary: Origin
server: cloudflare
priority: u=2,i

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5697
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7646926639373327599

43 B
61 B

36ms
33ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=7646926639373327599
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=7646926639373327599
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.36; 206.66.99.36; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: cc0f1379-3c47-404d-936a-2dbd6648a3cc
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 5697
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=45dbffe5-514f-428f-98ff-67b8707d39e0
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEKzkwx3NTLBWwv0VTwmS3Gg&google_cver=1

42 B
60 B

55ms
54ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEKzkwx3NTLBWwv0VTwmS3Gg&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEKzkwx3NTLBWwv0VTwmS3Gg&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 289
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 5697 95 B
767 B 160ms
77ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=1663f37f-c70f-4968-8d67-7f9d7a6a9934

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5697
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=763f5531-000e-4125-8b3e-7b07debc5fe6-68119d1f-5553&gdpr=0&gdpr_consent=

43 B
61 B

36ms
36ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=763f5531-000e-4125-8b3e-7b07debc5fe6-68119d1f-5553&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=763f5531-000e-4125-8b3e-7b07debc5fe6-68119d1f-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: A

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 05F2 0
0 46ms
42ms Fetch
image/gif 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOHhEpjU50kTvxMqaIHZP8YfajKfKvKOD9MLJBUSwQzLrZjxRe6LZZDH0qQcDcHDEpgbiyiMR2TFu9BZZmhyWh3QHxVUS1l5FotvNWSjGZ9SLKDc0axxbM7zDqhD0h-8hH5YI6wiX8Kg-t8gTKI09GqMMW-Yjxpog684BIZYZUbEGETugGHefTjaepos2-Qw2WOjJ2Ufc46nnkK9JONcUc5sDwLAy-qY8mQtZsAreWUpYNvOnRef0MA4e3L8c_bNjkthPUswUg6MtjOYXagfiWw_6GSOlWdTB3VurPUH3h4WAn1ylstixOCNt0yHDnV3nmL1HLMXJx9MG5XR9Xndfjse3lh8BvPY8I0_g9dkz_G9eOh0GpAIwDpISHzwVHU5aFM49E4s-QSPWdlo_Mb2NoNl9-0BC3fg9m7OWX92lMKgHlcrKxScHTvq44WwHeNkg-LDjkXv2lRlA2LXtVUFxbPSPS7GoZrHV9tnrTfqDaR-XPoMqiVrfOfneciwncarBcLativbPUg7TsRBLv2pRrm9AxMF3AB0hwhrBMnaYyuaTRkJQm169ifzOEUgzSHzCMpoIpSuoiqTXr8D46YdxUnnAdez7A&sai=AMfl-YSxTVimUNvZH_lL3OTg9yWcg7duk47aO6vai_tvn6Xu5EEBsoDZu0RmyW2ilpIHQ5foGPWsBLHMDZy_mIlzStFAgl4lgkRnQ7Zq1qtgTMWY-r5mmhhcQTOOFYoB&sig=Cg0ArKJSzGwEaL3gJmpQEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 03:46:39 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5697
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=d63a2909-d831-435c-b2f5-047a8b0cccef

43 B
61 B

34ms
33ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=d63a2909-d831-435c-b2f5-047a8b0cccef
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: 6b5510f2-2d38-49bb-9a6e-69843b3fe99f
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=d63a2909-d831-435c-b2f5-047a8b0cccef
Content-Length: 112
Date: Wed, 30 Apr 2025 03:46:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame 5697
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=z0sKvzWOzcEh8qv8mv9igg==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

35ms
33ms

Image
image/gif

35.186.253.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 206.66.99.36
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 807B 44 KB
0 0ms
0ms Script
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 8def8d0d480896d5713d17bfe7561ce293eb12921307face99f6ddf548cf9c2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

Response headers

cache-control: max-age=15357
content-encoding: gzip
expires: Wed, 30 Apr 2025 08:02:35 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Wed, 30 Apr 2025 03:46:38 GMT
last-modified: Tue, 29 Apr 2025 08:03:30 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 45B8 0
128 B 50ms
28ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 29 Apr 2025 21:26:22 GMT
server: nginx

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 28C6 7 B
1 KB 124ms
39ms XHR
application/json 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 6E7F 3 KB
3 KB 35ms
35ms Document
text/html 44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 23f377d055d78accdab24d1e01db0120af139efa1e3f2d565d1a519ce5a6d085

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 5B4B 7 B
1 KB 51ms
29ms XHR
application/json 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://creativecdn.com/cm-notify?pi=rise
https://creativecdn.com/cm-notify?pi=rise&tc=1
https://cs.yellowblue.io/cs?aid=11610&id=LaqgZa-3JSs5xdvB66DuXg7Uk_bDNwnMy82xzr7T7TY&pi=rise&tc=1

0
354 B

29ms
29ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11610&id=LaqgZa-3JSs5xdvB66DuXg7Uk_bDNwnMy82xzr7T7TY&pi=rise&tc=1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://cs.yellowblue.io/cs?aid=11610&id=LaqgZa-3JSs5xdvB66DuXg7Uk_bDNwnMy82xzr7T7TY&pi=rise&tc=1
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT, Wed, 30 Apr 2025 03:46:40 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11580%26puid%3D33XUSERID33X
https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=212824471371533

0
354 B

55ms
55ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=212824471371533
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=212824471371533
pragma: no-cache
referrer-policy: unsafe-url
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: 33XP020

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?gdpr=0&gdpr_consent=&profile=342&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11614%26id%3D%24%7BCRITEO_USER_ID%7D
https://cs.yellowblue.io/cs?fwrd=1&aid=11614&id=k-2_ZDDvlZqr5Y4gWvOsIU5GZ_DTzyEiXBgCHLrw

0
354 B

50ms
45ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11614&id=k-2_ZDDvlZqr5Y4gWvOsIU5GZ_DTzyEiXBgCHLrw
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11614&id=k-2_ZDDvlZqr5Y4gWvOsIU5GZ_DTzyEiXBgCHLrw
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://sync.go.sonobi.com/us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d

0
354 B

39ms
38ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-cache, no-store, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=0b3ebd3a-b7e4-4eff-8a5f-aafda49e161d
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 30 Apr 2025 03:46:39 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-187
x-xss-protection: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://match.sharethrough.com/universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422
https://cs.yellowblue.io/cs?aid=11587&uid=4498051a-3fe6-4848-a423-c2bf1a3410a1&gdpr=0

0
354 B

64ms
63ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=4498051a-3fe6-4848-a423-c2bf1a3410a1&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cs.yellowblue.io/cs?aid=11587&uid=4498051a-3fe6-4848-a423-c2bf1a3410a1&gdpr=0
content-length: 0

GET
H2 503 oRTB
sync.inmobi.com/ Frame 6E7F 81 B
81 B 111ms
28ms Image
text/plain 35.212.31.229
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/oRTB?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.31.229 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 229.31.212.35.bc.googleusercontent.com
Software: envoy /
Resource Hash: e072b8ccba034ba778fc1c520028bb9d0f8158420882f274825d12c7bb3b2cc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: gzip
date: Wed, 30 Apr 2025 03:46:39 GMT
x-envoy-overloaded: true
content-type: text/plain
vary: Accept-Encoding
server: envoy

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://bh.contextweb.com/bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=YGkAze12Nm1h&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0

0
354 B

37ms
35ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=YGkAze12Nm1h&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=YGkAze12Nm1h&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-cc58c7bc8-7mr55
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-US
server: Jetty(12.0.17)

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11606%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=3935146244966098880

0
354 B

50ms
49ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=3935146244966098880
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

access-control-max-age: 86400
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11606&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=3935146244966098880
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://contextual.media.net/cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3C...
https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3889863995725258000V10

0
354 B

52ms
49ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3889863995725258000V10
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 8
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3889863995725258000V10
timing-allow-origin: *
pragma: no-cache
expires: Wed, 30 Apr 2025 03:46:40 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
content-length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: text/html
server: Apache

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://ads.stickyadstv.com/user-matching?gdpr=0&gdpr_consent=&id=3663
https://cs.yellowblue.io/cs?aid=11601&id=ec20d42595659d5b76ade3ca7dd5b&gdpr_consent=&gdpr=0

0
354 B

50ms
50ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=ec20d42595659d5b76ade3ca7dd5b&gdpr_consent=&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache
Location: https://cs.yellowblue.io/cs?aid=11601&id=ec20d42595659d5b76ade3ca7dd5b&gdpr_consent=&gdpr=0
Pragma: no-cache
x-sticky-vk: 1745984799996046-1187
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Wed, 30 Apr 2025 03:46:40 GMT
Server: nginx

GET
H2

204

CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 6E7F
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=

0
164 B

157ms
44ms

Image
text/plain

3.95.127.16
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 3.95.127.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-95-127-16.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

date: Wed, 30 Apr 2025 03:46:39 GMT

Redirect headers

location: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 95
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs.yellowblue.io/ Frame 6E7F
Redirect Chain

https://csync.loopme.me/?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D
https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=6d7341cd-e2df-4827-b603-af0ea13112a0&gdpr_consent=null&gdpr=0

0
354 B

44ms
43ms

Image
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=6d7341cd-e2df-4827-b603-af0ea13112a0&gdpr_consent=null&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=6d7341cd-e2df-4827-b603-af0ea13112a0&gdpr_consent=null&gdpr=0
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
server: _

GET
H3 200 setuid
prebid.intergient.com/ Frame 6E7F 0
788 B 51ms
49ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=rise&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=YhGj4f59CH

Requested by

Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93840da6eb36a67e-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/html
vary: Origin
server: cloudflare
priority: u=3,i

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 67E6
Redirect Chain

https://ssp.disqus.com/redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716
https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119

0
354 B

42ms
42ms

Document
application/javascript

44.208.234.29
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.208.234.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-208-234-29.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Wed, 30 Apr 2025 03:46:39 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: no-store
content-length: 0
expires: 0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-faa002f8-2637-30bf-be7c-779c8efeb119
pragma: no-cache

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame A023 2 KB
1002 B 849ms
337ms Document
text/html 51.222.39.185
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.185 , Canada, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ip185.ip-51-222-39.net

Software

Resource Hash

d6b9ac8ccff69f2de32254b96a2bb180535f809c2d8059d40be5844a8cbad026

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 870
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 8C1A
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage
https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

269 B
0

0ms
0ms

Document
text/html

23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 30 Apr 2025 03:46:39 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT
location: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
server: AkamaiGHost

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 8C1A 44 KB
0 0ms
0ms Script
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 8def8d0d480896d5713d17bfe7561ce293eb12921307face99f6ddf548cf9c2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

Response headers

cache-control: max-age=15357
content-encoding: gzip
expires: Wed, 30 Apr 2025 08:02:35 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11448
date: Wed, 30 Apr 2025 03:46:38 GMT
last-modified: Tue, 29 Apr 2025 08:03:30 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3

200

setuid
prebid.intergient.com/ Frame 5B4B
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=&khaos=MA3E9NRV-B-HOUF
https://prebid.intergient.com/setuid?bidder=rubicon&uid=MA3E9NRV-B-HOUF

0
874 B

51ms
50ms

Image
text/html

2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=rubicon&uid=MA3E9NRV-B-HOUF

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 93840da74be4a67e-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 03:46:39 GMT
content-type: text/html
vary: Origin
server: cloudflare
priority: u=3,i

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MA3E9NRV-B-HOUF
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 28C6
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MA3E9NRV-B-HOUF

0
143 B

94ms
93ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MA3E9NRV-B-HOUF
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: B67DEBA59506468AAA6E623566F3BEEF Ref B: PHL30EDGE0220 Ref C: 2025-04-30T03:46:39Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYz9sPJa8rSpUQldRvcfg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 03:46:39 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MA3E9NRV-B-HOUF
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
Pragma: no-cache
content-length: 0

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 28C6 43 B
855 B 551ms
274ms Image
image/gif 52.95.115.255
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.95.115.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 2B27BBJ25X5Q5HQP046M
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 30 Apr 2025 03:46:40 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 28C6
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

94ms
29ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=91452127-6d77-454d-9678-41206a260217&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Wed, 30 Apr 2025 03:46:39 GMT
server: Kestrel

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 28C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELhKHw2ALvEUhaKhuqnzmtE&google_cver=1

42 B
1 KB

147ms
71ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELhKHw2ALvEUhaKhuqnzmtE&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELhKHw2ALvEUhaKhuqnzmtE&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Wed, 30 Apr 2025 03:46:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 28C6
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUEzRTlOUlYtQi1IT1VG
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKaftccRs4BOuX2YVvL4i6I&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUEzRTlOUlYtQi1IT1VG&google_push=

170 B
188 B

44ms
44ms

Image
image/png

64.233.180.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUEzRTlOUlYtQi1IT1VG&google_push=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

64.233.180.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 03:46:40 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUEzRTlOUlYtQi1IT1VG&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 28C6
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/6mWqbaK3l6Be1MZOLCRsDA?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-93ZObQdE2oLwzoM2fXZXCDGizjqJETFT49paHQ--~A

42 B
1 KB

54ms
28ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-93ZObQdE2oLwzoM2fXZXCDGizjqJETFT49paHQ--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: abdced99217677a3fee148679dae3157
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-93ZObQdE2oLwzoM2fXZXCDGizjqJETFT49paHQ--~A
age: 2
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 30 Apr 2025 03:46:40 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 28C6 43 B
855 B 50ms
45ms Image
image/gif 98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: GWQFMJNER43TPJX4JPJQ
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 30 Apr 2025 03:46:39 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 28C6
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NzBkNzVjOWU2MTBjNDhhOTc4YTE0MDVmY2FjNjEzMWIzOGM3NGZiZA

170 B
188 B

45ms
45ms

Image
image/png

64.233.180.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NzBkNzVjOWU2MTBjNDhhOTc4YTE0MDVmY2FjNjEzMWIzOGM3NGZiZA

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

64.233.180.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 03:46:40 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NzBkNzVjOWU2MTBjNDhhOTc4YTE0MDVmY2FjNjEzMWIzOGM3NGZiZA
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 28C6
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=MA3E9NRV-B-HOUF&ex=d-rubiconproject.com&status=ok

43 B
479 B

53ms
35ms

Image
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MA3E9NRV-B-HOUF&ex=d-rubiconproject.com&status=ok

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS