paint.toys Open in urlscan Pro
15.197.167.90 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 77735
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Wed, 30 Apr 2025 05:59:49 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JT2MFBPN6JRN6PY51HJNDZ3N

Redirect headers

accept-ranges: bytes
age: 77735
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Wed, 30 Apr 2025 05:59:49 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JT2MFBM3G3AM1RPM52C2JWGV

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 419ms
227ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39e7467f104443cdcd611a7ed69212308c518ac689cb2c6d795bb5571b30d1aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 9384d0b96853996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 83ms
81ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 50377
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JT2MFBSF2HM4781HPJC3CTF9
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 05:59:49 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 159ms
158ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 77735
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JT2MFBSFY0T839EKEWQCRX9E
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 05:59:49 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 91ms
90ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 79097
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JT2MFBSFCBT834DEN2DABMPA
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 05:59:49 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 83ms
82ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 50377
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JT2MFBSFAGJ4PWWHP2HV5AT0
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 05:59:49 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 82ms
80ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 50377
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JT2MFBYGDA4Z16W2JG29YR3V
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 05:59:49 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 83ms
81ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 50377
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JT2MFBYM33HJQAPQ9KVRP38S
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 05:59:49 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
1 KB 116ms
89ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da6be968034690bbf41116b7eb48ea242cc81c1dd10285a41a02041577dc673a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9384d0b97856996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 366 KB
123 KB 447ms
160ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f02a2869d310b07f4b290b7d2ef4dbdb127dae2dc3ebe4b716a713729408b0bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1072:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1072:0"}],}
expires: Wed, 30 Apr 2025 05:59:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1072:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1072:0
content-length: 125479
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
41 B 83ms
82ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 79097
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JT2MFBYMZ4F6X56V3X0RBQ5D
cache-status: "Netlify Edge"; hit
date: Wed, 30 Apr 2025 05:59:49 GMT
content-type: image/png
server: Netlify

GET
H2 200 bb95_5380.v2.js Show response
faucetfoot.com/chunks/78750294f43a1e52/ 68 KB
25 KB 272ms
97ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/chunks/78750294f43a1e52/bb95_5380.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1760148137 /

Resource Hash

5df1da2a23d7d9d1f1fc4eb24a3f667b12fbefff7274af68846d1f610b74f8be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"438c599e3d9cdca7ba703f7cf72c172c113eef78ab17becd77b4da9fa9f0110c"
via: fen-hoothoot-us-west1-spot-079b.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1760148137

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 316ms
161ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4bab46bb2c027fd469028f111e44bc763f01bda344e3ab042f97f778311dec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 430 / 20208 / 31092037 / config-hash: 7875046863786205115
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 05:59:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33913
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 100ms
100ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 2179
cf-ray: 9384d0baed0d996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 411 B
363 B 79ms
79ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cbab43d2db3b77efdbf5cae66c7f8e202c70b3c136237f4f977bef40d86507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a2f607b2abbb34303d7b9531c1a9ebcc"
age: 4433
cf-ray: 9384d0baed1d996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.816717f0fefdba312f2f.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
2 KB 87ms
86ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faa04735dd36414ea1be1f8e0ecce4c41f47ccc65c94e754c4073e1f6a59c115

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"cd64d4c5fb9e686de5a9d31f5c6e1020"
age: 4433
cf-ray: 9384d0bb6ee9996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.25cd0c88862d62596ad5.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 462 KB
140 KB 156ms
156ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f0fb98629bdcde55be36d3852ea70d065674c404f1c63380b750816c5050720

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a83125d38dc322a379d22cc11148e4b4"
age: 4432
cf-ray: 9384d0bb6eeb996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 559 B
444 B 83ms
83ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 4424
cf-ray: 9384d0bdadf0996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 6664 503 B
427 B 296ms
82ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 4432
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9384d0bf0afcf907-LAX
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 05:59:50 GMT
hw-country-code: US
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 6439 503 B
0 291ms
291ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 442a185c07d404d948999253b5e6ff2de7a68af9bba5b48819a56e436f10d66b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 4432
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9384d0bf0afcf907-LAX
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 05:59:50 GMT
hw-country-code: US
last-modified: Thu, 24 Apr 2025 13:48:11 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/1/desktop/Chrome/ 581 B
917 B 445ms
131ms XHR
application/json 2600:9000:24f1:7000:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/1/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:7000:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f3a1a856ddfadae10206ca02a46c98e9c0b09818fb804b24f37cedc9e3b9c799

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 3071
via: 1.1 74e6dd86eff86d5443ebe1a2ced7df88.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 581
x-amz-cf-id: Vu6kyrXZzlU2UtY08SA5G7xrB6pnH1uPM1Vn7RSwsTgqvBfcu-0dtQ==
date: Wed, 30 Apr 2025 05:08:40 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 148 KB
39 KB 235ms
79ms Script
application/javascript 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 935c577e049e7e6b2390df7546eea11a24b5676962ba8eaaed3aa0060fe83dc9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "9a6a4be7cde4e31ca272bb8115a08ac9"
via: 1.1 google
cf-ray: 9384d0beca34cb7d-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39596
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: application/javascript
last-modified: Wed, 30 Apr 2025 05:19:43 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.12d39b3042a89bfe935d.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
2 KB 84ms
84ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/ccpa.12d39b3042a89bfe935d.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 109c88771b4dd248e3dca670efe895b5aaefb0ee49e1cca776b2640717a933ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"206627f4662eb69e99a3cb421866652c"
age: 4427
cf-ray: 9384d0bdde92996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:10 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 358 KB
86 KB 445ms
155ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e8038af98d7bb29f3afeaa574476bffe2ff88d6719b5288794c91f138d5a7608

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"9d8e51445fe1950b9a70539c4015f393"
age: 447
via: 1.1 f6d7fdc57860c8c79f694e99b07ead5a.cloudfront.net (CloudFront), 1.1 749177a97cae42477f22c33c927ca0ce.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 7j5p4ILqvj9IBHeKL9ZEFjnicvTLA-2McEr4gItfeBVCpJTJqZK2KQ==
date: Wed, 30 Apr 2025 05:52:25 GMT
content-type: application/javascript
last-modified: Mon, 28 Apr 2025 18:20:18 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
586 B 674ms
223ms Image
image/gif 2606:50c0:8003::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 9e381159a6c0985936fc63d77460e1a645e3e264
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 1677:33CC0B:7DE737:907C74:67FC845C
expires: Wed, 30 Apr 2025 06:04:51 GMT
x-cache: HIT
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: image/gif
x-served-by: cache-mad2200108-MAD
x-cache-hits: 2
source-age: 32
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1745992791.223074,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
480 B 423ms
132ms Image
image/gif 2600:9000:247b:9a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?ab=1&zoneid=935180_advertisement_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:9a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 25891
x-cache: Hit from cloudfront
x-amz-cf-id: vftd0gUkPAxD--v8ViPMi8f1YV58OeKVFbLYbLr8kNyCjh3GnwrZvQ==
date: Tue, 29 Apr 2025 22:48:21 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 43504ac56caa49011c8a16d1cb156142.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/ 526 KB
166 KB 138ms
138ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e8678196c5296c2c0e37be38648399862f4b664a98418f2fe1b49938aa9a4c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 207378775494229417
age: 71882
x-content-type-options: nosniff
expires: Wed, 29 Apr 2026 10:01:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 29 Apr 2025 10:01:48 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169891
x-xss-protection: 0
server: cafe

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 435ms
146ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 83735
via: 1.1 177517a7a813d3db43efccb1bf2be96a.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: efLqTvcHSqkx9Euj6AYNGa-FT1kC2u8P9q5I0YAjnEnQ7gSwmUSz9g==
date: Tue, 29 Apr 2025 06:44:17 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
109 KB 158ms
157ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54s1v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

35de50587f2721c6a6adfc2f80797e460941edb83c1623337392bc21a9ed12da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1072:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1072:0"}],}
expires: Wed, 30 Apr 2025 05:59:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1072:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1072:0
content-length: 111542
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 442ms
149ms Fetch
text/plain 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54s1v9101576445za200&_p=1745992789780&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004&cid=132795969.1745992791&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745992790&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1755
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504290101/ 64 KB
23 KB 143ms
142ms Other
text/plain 142.251.40.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504290101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de83d54c3c01768225e8fb034f65dd15098c70db8b2cd23e4708b9f8c08bd43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 9807650885361896136
age: 55714
x-content-type-options: nosniff
expires: Tue, 06 May 2025 14:31:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 29 Apr 2025 14:31:16 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23837
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504290101"

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 238ms
82ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8193
x-goog-stored-content-encoding: identity
expires: Thu, 01 May 2025 05:59:51 GMT
x-goog-stored-content-length: 43
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9384d0c069cfd7cc-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 291ms
137ms Image
image/x-icon 142.250.80.6
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.6 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 21149
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 01 May 2025 00:07:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 00:07:22 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
567 B 236ms
81ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.1667353214587427
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8193
x-goog-stored-content-encoding: identity
expires: Thu, 01 May 2025 05:59:51 GMT
x-goog-stored-content-length: 43
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9384d0c069d2d7cc-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 6664 17 KB
7 KB 78ms
77ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4429
cf-ray: 9384d0bf9cdaf907-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250423.1/iframe/ Frame 6439 17 KB
0 73ms
72ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250423.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4429
cf-ray: 9384d0bf9cdaf907-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:12 GMT
vary: Accept-Encoding
server: cloudflare

GET 590292d6-13a4-4b39-903e-17e4b281b0b2
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 394ms
130ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 30 Apr 2025 05:59:50 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 181221
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 219ms
82ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75d6af1df26141fc077df396b5294b32da316143409f9796584d395d8921f48d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 9938
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1745982853&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=OLDWSNkzbxIF2zVzKARX6J6hecjqAw0CE%2B%2FjlgOXrhk%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Wed, 30 Apr 2025 03:14:13 GMT
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1745982853&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=OLDWSNkzbxIF2zVzKARX6J6hecjqAw0CE%2B%2FjlgOXrhk%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=86400
via: 1.1 vegur
cf-ray: 9384d0c109def79b-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250423.1/ 3 KB
1 KB 77ms
77ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250423.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/runtime.816717f0fefdba312f2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 156
cf-ray: 9384d0c02dff996a-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/javascript
last-modified: Thu, 24 Apr 2025 13:48:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 414ms
134ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 05c7a1abd019db17a0f00e1f737ef37e231756eb59c21630cb5ad3c439342452

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 444 KB
141 KB 464ms
171ms Script
text/javascript 2607:f8b0:4006:808::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2df469bf671e611a21b132334f159ce53644f1f6acf75f5fc54e3f3faead4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5159063225277301318
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 05:59:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 143605
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 646ms
213ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-235-141-11.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
775 B 414ms
139ms Fetch
application/json 44.216.112.86
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.216.112.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-112-86.compute-1.amazonaws.com
Software: /
Resource Hash: 808ff91dab6e9f1cb0c8af16136e28c00151ac06802833b34775e3621b4f0df1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
687 B 422ms
130ms Fetch
application/javascript 34.202.85.19
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.202.85.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-85-19.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: fddd4dc44eeee228d711e4b191b85af798f1907a822296dcc64a1553aab4a492

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 250ms
96ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: cc18c31e5a637dcdd512cbba57787eb8e867c7e03408bd8fa8d133c0fa7a3311

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 30 Apr 2025 05:59:50 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 480 B
892 B 411ms
139ms Fetch
text/plain 54.235.141.11
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jt2mfd0farfe23jj9rb9625z&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.141.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

f72d951da1ec82cf22de28439230e1cbca20845686924e7c298d7c31fdd423b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: f5d3ceb63156c9d9
request-time: 6
access-control-allow-credentials: true
expires: Thu, 01 May 2025 05:59:51 GMT
access-control-allow-origin: https://paint.toys
content-length: 480
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=3WhelnxSVktXRFpCWUgvL2wwb0tTbm13Mis0VmQ2ODYzbWx2ZTUzZTRjUkZlQ3FjMXU0QzFWZm0zS3E5emQvVWI1T3AwUWF1VWQ4YUI0WktrcW5ETzM2YVFnYlQ1TkRmM2JjMzZZOURaUGdIR0JRcTdOdlBKSEErai9rWT...

360 B
942 B

380ms
127ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=3WhelnxSVktXRFpCWUgvL2wwb0tTbm13Mis0VmQ2ODYzbWx2ZTUzZTRjUkZlQ3FjMXU0QzFWZm0zS3E5emQvVWI1T3AwUWF1VWQ4YUI0WktrcW5ETzM2YVFnYlQ1TkRmM2JjMzZZOURaUGdIR0JRcTdOdlBKSEErai9rWTZWalNIdnZqOHpHaVVuNmJJNGVlUWo1ZDRhUmdzSXVVa0MwbVRpelJVQ2pTYXA3cHFFSUdGRUkzTURkdGg0UUtIcHhrQWluK0xTUkRSWHJFWXdnUUZIeWhaYWdnbEhBOU9zZE9GVXdFOUpsSDZRcW8vcEEwPXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

470c082555d3d8b3cb448257ffc4fbfd1bcd5976c32b418fe7d854ed88d2cb48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 555200
expires: 0
access-control-allow-origin: null
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=3WhelnxSVktXRFpCWUgvL2wwb0tTbm13Mis0VmQ2ODYzbWx2ZTUzZTRjUkZlQ3FjMXU0QzFWZm0zS3E5emQvVWI1T3AwUWF1VWQ4YUI0WktrcW5ETzM2YVFnYlQ1TkRmM2JjMzZZOURaUGdIR0JRcTdOdlBKSEErai9rWTZWalNIdnZqOHpHaVVuNmJJNGVlUWo1ZDRhUmdzSXVVa0MwbVRpelJVQ2pTYXA3cHFFSUdGRUkzTURkdGg0UUtIcHhrQWluK0xTUkRSWHJFWXdnUUZIeWhaYWdnbEhBOU9zZE9GVXdFOUpsSDZRcW8vcEEwPXw&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 233199
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 30 Apr 2025 05:59:51 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_de5a476f-20fb-4051-ab52-a1a8e3ec0176_1745992791029
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfZGU1YTQ3NmYtMjBmYi00MDUxLWFiNTItYTFhOGUzZWMwMTc2XzE3NDU5OTI3OTEwMjkQABoNCNf4xsAGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=c163453b1dd7c26c7c9707be1c1a8d16bc20f655eafc4e5535f21542af61bbd6791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c163453b1dd7c26c7c9707be1c1a8d16bc20f655eafc4e5535f21542af61bbd6791426b5417dce21&rand=02972249
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c163453b1dd7c26c7c9707be1c1a8d16bc20f655eafc4e5535f21542af61bbd6791426b5417dce21&rand=02972249&expected_cookie=4bc1623c-b1fd-4b8b-bf7a-a197cfd3c521

0
143 B

109ms
108ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=c163453b1dd7c26c7c9707be1c1a8d16bc20f655eafc4e5535f21542af61bbd6791426b5417dce21&rand=02972249&expected_cookie=4bc1623c-b1fd-4b8b-bf7a-a197cfd3c521
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 5480B00D82144CFF8A98460624FA40E3 Ref B: LAX311000115029 Ref C: 2025-04-30T05:59:52Z
x-li-fabric: prod-lor1
x-li-uuid: AAYz+KApp8oeUNAohN4q5A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 05:59:51 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: /db_sync?pid=10339&puuid=c163453b1dd7c26c7c9707be1c1a8d16bc20f655eafc4e5535f21542af61bbd6791426b5417dce21&rand=02972249&expected_cookie=4bc1623c-b1fd-4b8b-bf7a-a197cfd3c521
x-msedge-ref: Ref A: 7F2A03FB040647249B39FB30A9749A18 Ref B: LAX311000115029 Ref C: 2025-04-30T05:59:52Z
x-li-fabric: prod-lor1
x-li-uuid: AAYz+KAniSAqUiiL9sfxkg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 05:59:51 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_de5a476f-20fb-4051-ab52-a1a8e3ec0176_1745992791029
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_de5a476f-20fb-4051-ab52-a1a8e3ec0176_1745992791029

1 KB
2 KB

132ms
131ms

Script
application/javascript

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_de5a476f-20fb-4051-ab52-a1a8e3ec0176_1745992791029
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: 7affeee77de5e60f713e801fb2af283f8ccc70086f15277679d03504d1717b1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:51 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_de5a476f-20fb-4051-ab52-a1a8e3ec0176_1745992791029
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:51 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 150ms
149ms Fetch
text/plain 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je54s1v9102396898za200zb9101576445&_p=1745992789780&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103173737~103173739~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004&cid=132795969.1745992791&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1745992791&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1745992789780&tfd=2065
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je54s1v9101576445za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/plain
server: Golfe2

POST
H3 200 36637ed5f2_b21577dde2be456aa6 Show response
faucetfoot.com/u/2c7c1e103907cf/ 295 B
319 B 190ms
105ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/u/2c7c1e103907cf/36637ed5f2_b21577dde2be456aa6

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/chunks/78750294f43a1e52/bb95_5380.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

hoothoot/1760148137 /

Resource Hash

2048f05a370a293490650be174174e0345f1ba2a040d7e9b452a77c659c2bc0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-test-jqg4.gce-us-west1, 1.1 google
expires: Wed, 30 Apr 2025 05:59:50 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1760148137
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 199 KB
65 KB 479ms
182ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

56674888d399d2342d96aafaa70934b1509c0b15cc9685563e8cfe7174322bbc

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-4pCgCw7cfy1JgiaeqDRW4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmII1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GTdtfEW62EgbtK-zdoFxEI8HNd_HDvAJnDj-YlFTEoaSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRfFGBkamBiZG5noGBvEFBgC6rTyM"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-4pCgCw7cfy1JgiaeqDRW4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 446ms
162ms XHR
application/json 44.198.22.46
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.198.22.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-198-22-46.compute-1.amazonaws.com
Software: /
Resource Hash: f00dd05a986f12ffd314bcf6568ec55f6251ca2ef64e69a4ce6ca60a4339b1e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=utf-8

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 393ms
131ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 73417
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: uNWHKG6yPOB5k05zk7qfo91gIUqnoU-nL4ukeqGhYik_Iu4nvJukcw==
date: Tue, 29 Apr 2025 09:36:15 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 44ffe5f6f95421818455d39547956aa4.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
831 B 418ms
132ms Script
application/javascript 18.173.132.67
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-67.jfk52.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 3199
via: 1.1 e6b4dbead926e5325f87837a8678a68a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: LYvNHKLCYxK11OeDSTukOdxrMhDZupfZQWnzkYr2x-xX14Effwx7Sg==
date: Wed, 30 Apr 2025 05:06:32 GMT
content-type: application/javascript
x-amz-cf-pop: JFK52-P2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 137ms
137ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 20684
access-control-allow-credentials: true
via: 1.1 749177a97cae42477f22c33c927ca0ce.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: 2tOxDOv822lemkthJJpZX9eYHNs_BbpGkM5uVBoCb_7IbWvV6TeH4Q==
date: Wed, 30 Apr 2025 00:15:07 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
375 B 584ms
280ms Fetch
application/json 3.168.101.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&pid=2TaG8uzzzk6sd&cb=0&ws=1600x1200&v=25.424.1149&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=60e20e14-5983-43c0-9987-d467e70a848b&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.101.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-101-29.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 2cb12387b5c8bb91522882a2a1ea1540.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: ykXA8IADnbuwkWMshJge7VQalKXYXuF6gGzY7NSKtnWP8xmTPL-PZQ==
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK52-P6
server: Server

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 6B60 1 KB
2 KB 220ms
69ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 3418
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:02:53 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwpnAjRdyhDYr6GxGKGODk3NCejrf68FpPieqmHEqkPnLUOLW95RCyR3VW6NZypmVdkZiRRccFQ

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame C203 2 KB
1 KB 438ms
133ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=69843
content-encoding: gzip
content-length: 859
content-type: text/html
date: Wed, 30 Apr 2025 05:59:51 GMT
expires: Thu, 01 May 2025 01:23:54 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 243ms
140ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://prebid.intergient.com/cookie_sync

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a2961a7c34a8da45ebe8ff1cc10955f37a47a694be218da1ce3e5691ed18bef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9384d0c36f26ef78-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 20 KB
11 KB 2629ms
2530ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://prebid.intergient.com/openrtb2/auction

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7aa71be9e640e4dd8cce84b9f35f2026090460bd16247f99782a0c5b967bd06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: application/json
vary: Origin
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9384d0c36f2aef78-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 538ms
271ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 688 B
1 KB 539ms
203ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=724daf87-3c2c-47dd-bf41-341955377473&l_pb_bid_id=68dd0184a95a43b8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=bcfee221-da5d-469e-8c08-7c440e726662&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.2690101007873287
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: d03f8a38a325d933abc598a6979cc88ec7d8b58b9052fd94b5a76fd1e9876c57

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 520 B
868 B 577ms
241ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=724daf87-3c2c-47dd-bf41-341955377473&l_pb_bid_id=69bd17394977ef98&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=986aedca-e36c-4f7a-a6cb-7e39b327f863&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.7163871733830325
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 58d10e8af91c405b335e7dbb8ad8156a0c671248ef3f1798168b9c6c4549fabc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 520
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 526 B
1 KB 468ms
134ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=724daf87-3c2c-47dd-bf41-341955377473&l_pb_bid_id=7037dff9ebfd13d&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=9e8c204a-2c50-4540-9600-2d78da5890b9&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.7988623500590215
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 7fd1a40103c396e86856efe6e167a74a6e9c0014529adf0ab916312c46f00f01

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 526
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 526 B
876 B 468ms
135ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=724daf87-3c2c-47dd-bf41-341955377473&l_pb_bid_id=71f6f343734e58c8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=c4abce06-8277-43da-b56e-c6252e827fd2&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.08644651100302825
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 7311fdf0c8b35c4ebab0395065d4220ca53fc90a712dccfd68e35bb381100065

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 526
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 459ms
185ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a706ce2a8ecd58ed9ecd6bf5454e03e0bcddae12e976ac788e0415c2a62f4aae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 439ms
137ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 425ms
138ms Fetch
application/json 35.82.181.218
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745992791479&to=600&aun=pw-160x600_atf&pubcid=85705373-e58a-4bf0-8195-9d4477b84ce4&33acrossId=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=bcfee221-da5d-469e-8c08-7c440e726662&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.82.181.218 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-181-218.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 425ms
139ms Fetch
application/json 35.82.181.218
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745992791480&to=600&aun=pw-160x600_btf&pubcid=85705373-e58a-4bf0-8195-9d4477b84ce4&33acrossId=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=986aedca-e36c-4f7a-a6cb-7e39b327f863&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.82.181.218 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-181-218.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 423ms
138ms Fetch
application/json 35.82.181.218
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745992791480&to=600&aun=leaderboard_atf&pubcid=85705373-e58a-4bf0-8195-9d4477b84ce4&33acrossId=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=9e8c204a-2c50-4540-9600-2d78da5890b9&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.82.181.218 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-181-218.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 424ms
140ms Fetch
application/json 35.82.181.218
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1745992791480&to=600&aun=leaderboard_btf&pubcid=85705373-e58a-4bf0-8195-9d4477b84ce4&33acrossId=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s%2FaFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5%2BtMRPp%2BZ7nGPqHDLO6f%2BRdlEg1%2BecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM%2FnNtc3jHvvWgZV33tjXGpiN9joWm7S%2FZfefrSF%2B3JHzWqgcOAqb966OqkwG%2FFGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D%2BVeedIoDUXyoGNzUun9J%2Fe8n%2BNySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6%2B85yML388gCqz4%2BSRXESEkbgkjZseeeoBa4u65epTSTOaVmCm%2B5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY%2B9i%2F62iNk9W067UjCrEWkFqkzc%2F5xHfjPFRTo3l6DKglfhseX%2BVIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4%2BgG79x%2FSCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751%2FCkAXjGMCUv3MjqR8%2F0ckLAEt4jIeqiMIut73tkolu18j6%2Bwbs7W2nWSYEQ6fYtxJuh8eI%2FHrDY%2BaHT6zU8tXVh0%2F%2FW5sDZfUyPN%2FU%2Bkb%2BcLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc%2Fjzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB%2BKLoqRnp24U2Vc%2BUrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh%2Fbz%2BkIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW%2FqyO2PnKOs2dGCXCz9TsE4uXrC3L%2BJ1W4qAz12hBEIT2lTYbfhvN%2F64zUpIgjM4LF9C%2FmM%2BA8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn%2Fh5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0%2B%2FDap0Ch1dyXJSzQd%2FVoa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=c4abce06-8277-43da-b56e-c6252e827fd2&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.82.181.218 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-181-218.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 556ms
258ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:51 GMT
server: nginx

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 563ms
290ms Fetch 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 05:59:51 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 602ms
328ms Fetch 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 05:59:52 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 582ms
309ms Fetch 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 05:59:52 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 731ms
462ms Fetch 146.190.187.150
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.150 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 30 Apr 2025 05:59:52 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
624 B 425ms
140ms Fetch
application/json 3.168.102.72
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-72.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 84ff5107a451ad11005411c49ddf8c2e93280ed11ab3ecdae2973633c0a9ea79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 4942ac6afe108c9d67b9bcd032c78848.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: gW-sKAQm7UAi6exwLPQIRN0xNjeKlXNUrOgpp0wjvk3b2ZaNMd39Fw==
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 247ms
99ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 1315456611a09a434d639c4ad63c06bd721e7c3c517b4dc14c19ab9e25af62b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.248
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/plain
vary: Origin

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
707 B 421ms
152ms Fetch
application/json 68.67.160.24
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 1e629094-6ec6-4b2a-8463-74193d03b9f8
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 05:59:51 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 38 B
663 B 273ms
126ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77d52a1f1611c6be1d1512f4f8136c93c3de4d09c6f25fefc5c0a18a1c33886b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aI8h%2BeB7GMSDhpEClniEF5dBWkmDDV3hZBWJzGIxrj2k7TawTUrM7h5IAm8wKNQsTQq7WPoghEbygsoxd1euEyhUnNxNtqXoEozDTtY%2B8ZK1cQ1tLIVEL1rpFgJjGv7pyEiIx6gZ"}],"group":"cf-nel","max_age":604800}
cf-ray: 9384d0c42f687bfb-LAX
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 38
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 145 B
608 B 409ms
246ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c302e8a38aba923de52bf1f8fe6508a7f9a54a363a6d8c3aaf6e5ded80409e7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9384d0c459e2f7bf-LAX
expires: 0
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 381ms
128ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=11291622019&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:51 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 568ms
271ms Fetch 3.236.217.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.217.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 436ms
142ms Fetch 3.236.217.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.217.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 565ms
270ms Fetch 3.236.217.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.217.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 560ms
266ms Fetch 3.236.217.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.217.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-81-174-250.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 450ms
147ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Wed, 30 Apr 2025 06:14:51 GMT
accept-ranges: bytes
content-length: 17407
date: Wed, 30 Apr 2025 05:59:51 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 148ms
145ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 80794
via: 1.1 177517a7a813d3db43efccb1bf2be96a.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: hd2jhcmhFP3_TqtAc5gP8G9g6nDa2p8i8UhqyNdFIrGeohDxlPZkoQ==
date: Tue, 29 Apr 2025 07:33:18 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 236ms
76ms Script
text/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&_it=amazon&partner_id=403
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 6922
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Mon, 05 May 2025 05:59:51 GMT
cf-ray: 9384d0c47fb10f19-LAX
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 232ms
86ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

572ec137575fa4799de7433a3f493bc02089ed14b410ac493262345f36c79be3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"a607a260772d524047ddaed6b9b4fbfb"
age: 30
expires: Wed, 30 Apr 2025 06:59:51 GMT
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/javascript;charset=utf-8
last-modified: Mon, 28 Apr 2025 11:21:41 GMT
vary: Accept-Encoding
x-amz-id-2: 39504IJ0Gk0KYyv1TOw4TImPX/C21+I2znYaSK6v6WZGvCkrUdYvtCzKxU69NfArjbpaA+tAI8lA0DA/14vu4w==
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: P9ZZXT9GZZ7AM7HV
cf-ray: 9384d0c46cc17d6a-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 577ms
277ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Wed, 30 Apr 2025 06:14:51 GMT
accept-ranges: bytes
content-length: 5252
date: Wed, 30 Apr 2025 05:59:51 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1745992791567&did=did-0046&se=e30&duid=8e413bd09c43--01jt2mfd0farfe23jj9rb9625z&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fwxqdz.zerr...
https://rp4.liadm.com/j?dtstmp=1745992791567&did=did-0046&se=e30&duid=8e413bd09c43--01jt2mfd0farfe23jj9rb9625z&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fwxqdz.zer...

13 B
370 B

414ms
133ms

Fetch
application/json

23.23.124.41
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1745992791567&did=did-0046&se=e30&duid=8e413bd09c43--01jt2mfd0farfe23jj9rb9625z&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjoz
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.23.124.41 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-23-124-41.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 8aff871a-2d7b-4938-9c89-2cf70e68cdab
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1745992791567&did=did-0046&se=e30&duid=8e413bd09c43--01jt2mfd0farfe23jj9rb9625z&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjoz
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 30 Apr 2025 05:59:51 GMT

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 414ms
131ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 428ms
132ms XHR
application/json 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 416ms
129ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250423.1/main.25cd0c88862d62596ad5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 427ms
131ms Image
text/plain 3.81.174.250
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.174.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 645ms
214ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

f9644de09906ff7b61ff5216efd323a7f59c4a43554522fb3ad5149b483fb7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MjdrOFV6QjNXZk5VZ1VwOHVzbFkwb1EwN2xqQzc4OThPWnAwbUR1ZWQ3YlU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MjdrOFV6QjNXZk5VZ1VwOHVzbFkwb1EwN2xqQzc4OThPWnAwbUR1ZWQ3YlU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

210ms
131ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:52 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Wed, 30 Apr 2025 05:59:52 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=5f3c15fa-5ad5-4cf0-a921-067639c86658&bid=1e2n4ou

70 B
440 B

184ms
131ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5f3c15fa-5ad5-4cf0-a921-067639c86658&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:52 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=5f3c15fa-5ad5-4cf0-a921-067639c86658&bid=1e2n4ou
content-length: 191
date: Wed, 30 Apr 2025 05:59:52 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-xZGOYsZE2pXwfGf01Jex2b9kUoN4xVLP23E-~A&gdpr=0

70 B
440 B

223ms
131ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-xZGOYsZE2pXwfGf01Jex2b9kUoN4xVLP23E-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:52 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-xZGOYsZE2pXwfGf01Jex2b9kUoN4xVLP23E-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=7107673749872378488&newuser=1&referrer_pid=m51mh00

70 B
440 B

283ms
130ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=7107673749872378488&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:52 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=7107673749872378488&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 05:59:44 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=653825730586760042&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

131ms
131ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=653825730586760042&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:52 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=653825730586760042&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 4873ce1a-dcfc-47db-b2ec-4bd400a71de7
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 05:59:52 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 407ms
129ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 30 Apr 2025 05:59:51 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 156222
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 AGSKWxWqtMLYkb1ngLKInbwpJhxDx2JbfurQhUE-9m0vcN68b2bBaWtMKx0HtDI-Rtv5DhlvXS-s2UKVTZOTmi05fagq6l384ox-ndHfHX5JGXROgTB_fWIIwMdVKe1bSbuDx46J6kyRAA== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 177ms
175ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWqtMLYkb1ngLKInbwpJhxDx2JbfurQhUE-9m0vcN68b2bBaWtMKx0HtDI-Rtv5DhlvXS-s2UKVTZOTmi05fagq6l384ox-ndHfHX5JGXROgTB_fWIIwMdVKe1bSbuDx46J6kyRAA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1OTkyNzkxLDk4NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJKaWNWU0RIaTJoVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJ3eHFkei56ZXJyYXNvZnQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.JicVSDHi2hU.es5.O/d=1/rs=AJlcJMwq3Q97UOg5poK2v0pfLNMQLWuccQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

88868d0c3d4838db9c1a90c521ae683d19463c4f18bd6879a25a6d0ba16f03fc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-v4QvaVvVxkbwHRcjoC6PBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmLw15BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GTdtfEW62EgbtK-zdoFxELcHDd-HDvAJjBhW7uWkkZSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRvJGBkamBiZG5noFBfIEBAFURO1Q"
content-security-policy: script-src 'report-sample' 'nonce-v4QvaVvVxkbwHRcjoC6PBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 7753 101 KB
28 KB 278ms
135ms Document
text/html 142.251.40.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38f00721657fd6de7b95747418618530426233d20866cee0737fabaef1ba2876

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 58
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28962
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 05:58:54 GMT
expires: Wed, 30 Apr 2025 06:48:54 GMT
last-modified: Mon, 28 Apr 2025 19:43:10 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 436ms
138ms Script
application/javascript 2600:9000:24f1:3a00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:3a00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 3384
x-cache: Hit from cloudfront
x-amz-cf-id: SEUOYLhAzIUJCLU88JVYKpIv6QOpWD0veq9m_ajleWnjv3Z8SIEbPw==
date: Wed, 30 Apr 2025 05:03:29 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 a5f1848a5a38100d334f5844f0df9eac.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 223ms
71ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 48954
x-goog-stored-content-encoding: gzip
expires: Wed, 29 Apr 2026 16:23:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 29 Apr 2025 16:23:58 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2Vwqe4JnUadVJpZopVR7AA9YhG_WDRJMgo-4-WeV4itms_wAQOF0ZRN2DDVkIFKuT9lukr4ZElp8
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 391ms
240ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 247f11e20729309397eb47fc50f29e2b

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 249ms
80ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 141128
cf-ray: 9384d0c82a75f7ad-LAX
expires: Sat, 03 May 2025 05:59:52 GMT
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 524ms
255ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Thu, 01 May 2025 05:59:52 GMT
access-control-allow-origin: *
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 253ms
83ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6192d7b9a03dc98c0490251dfd8f4f7b767bfb4c2726977fc3019a6635bdf342

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 85
cross-origin-resource-policy: cross-origin
cf-ray: 9384d0c8ab4ed7a7-LAX
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 30 Apr 2025 05:51:06 GMT

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 257ms
89ms Preflight
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 9384d0c74d3f7d17-LAX
content-length: 0
content-type: text/plain
date: Wed, 30 Apr 2025 05:59:52 GMT
expires: Thu, 30 Apr 2026 05:59:52 GMT
server: cloudflare

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
277 B 90ms
89ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f7f0f787e5d2911544c2ff35e5a688c1e1acb5a69942348d31072f87eaac8cc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 9384d0c7dd9d7d17-LAX
access-control-allow-origin: *
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 80EC
Redirect Chain

https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gd...
https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx...

943 B
1 KB

94ms
94ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 1411bfa3efd1f08b16b563e1642fd29d296cb4eb85ef04f33eb1f7d765edab82

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 943
content-type: text/html
date: Wed, 30 Apr 2025 05:59:52 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.248

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Wed, 30 Apr 2025 05:59:52 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.248

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 134ms
133ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Wed, 30 Apr 2025 06:14:52 GMT
accept-ranges: bytes
content-length: 17042
date: Wed, 30 Apr 2025 05:59:52 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 AGSKWxXSA-DG2dhv-7kfmSbvbG_axefmHCywXYPlFxYznA0m4Vspl27ZjXryCnwChj4rg3mWxp4DIfTfSAN3aPKif8UcYH3eurbzYzIMFSRrnV2V96f5VpukSQ7aTSnMRBD4hhnl70N7EA== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 178ms
178ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXSA-DG2dhv-7kfmSbvbG_axefmHCywXYPlFxYznA0m4Vspl27ZjXryCnwChj4rg3mWxp4DIfTfSAN3aPKif8UcYH3eurbzYzIMFSRrnV2V96f5VpukSQ7aTSnMRBD4hhnl70N7EA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1OTkyNzkyLDE2OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiSmljVlNESGkyaFUiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwid3hxZHouemVycmFzb2Z0LmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e77a70f8099f6599fab83153f9ee06e390af9f3f4c2842e71177e377342bf645

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hA_PLUCbGIhikMdQCNEimw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmII0JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GTdtfEW62EgbtK-zdoFxEI8HDd-HDvAJvDi068GRiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTAxMjcz0Dg_gCAwDA7zy0"
content-security-policy: script-src 'report-sample' 'nonce-hA_PLUCbGIhikMdQCNEimw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 215ms
214ms Fetch
text/plain 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 651ms
216ms Fetch
application/json 2001:41d0:701:1000::20ef
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::20ef , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: 14ab68074b46cd92e73bbe0b1200e09ff17dcd20de09a2c80c601f58a7258c29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 252ms
214ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

f9644de09906ff7b61ff5216efd323a7f59c4a43554522fb3ad5149b483fb7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 413ms
129ms XHR
application/json 2606:ae80:1471:19::1140
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:19::1140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Wed, 30 Apr 2025 06:29:52 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/json
vary: origin
server: nginx

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 215ms
214ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

64c91f03c20b1199d0f52eb3d9244873d88376c0107ba696db4ef0617d742394

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/json
vary: Origin

GET
H3 200 setuid
prebid.intergient.com/ Frame 80EC 0
450 B 230ms
155ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=8caf194c-c4a7-4d44-917a-45933b0bc7bf

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 9384d0c99c462f4a-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: text/html
vary: Origin
server: cloudflare
priority: u=2,i

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 80EC 170 B
409 B 430ms
151ms Image
image/png 142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:52 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 80EC 170 B
232 B 427ms
153ms Image
image/png 142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTkxZTQ1NDktYjQ0Zi0yMDA5LWVmMTYtZGYzZjcwYjJjYjUy

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:52 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 80EC
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=b5719683-7d38-7ead-faf6-8586ba500532&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=5f3c15fa-5ad5-4cf0-a921-067639c86658&ttd_puid=b5719683-7d38-7ead-faf6-8586ba500532&gdpr=0&gdpr_consent=

43 B
240 B

102ms
94ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5f3c15fa-5ad5-4cf0-a921-067639c86658&ttd_puid=b5719683-7d38-7ead-faf6-8586ba500532&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5f3c15fa-5ad5-4cf0-a921-067639c86658&ttd_puid=b5719683-7d38-7ead-faf6-8586ba500532&gdpr=0&gdpr_consent=
content-length: 335
date: Wed, 30 Apr 2025 05:59:52 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 80EC
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/21b6f0c7-ed94-ece4-cb21-93734507c87b?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-r2vuGBlE2p_pQM4tfNGpe25cDlZSL5L2yT8-~A

43 B
61 B

95ms
95ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-r2vuGBlE2p_pQM4tfNGpe25cDlZSL5L2yT8-~A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-r2vuGBlE2p_pQM4tfNGpe25cDlZSL5L2yT8-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 30 Apr 2025 05:59:52 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 80EC
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aBG8WQANh5miXgBh

85 B
172 B

218ms
217ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aBG8WQANh5miXgBh
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1745992793.349376,VS0,VE0
age: 1463
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: image/png
x-served-by: cache-mad22057-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 6731

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aBG8WQANh5miXgBh
x-timer: S1745992793.044241,VS0,VE86
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Wed, 30 Apr 2025 05:59:53 GMT
x-served-by: cache-mad22057-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 80EC
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=7107673749872378488&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

95ms
95ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=7107673749872378488&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=7107673749872378488&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 06:00:08 GMT

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 386ms
235ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 7e264048e1661ac8aa291a7aa9aca4e63893e5bcbcfe656d956f457f71840609

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/json
x-cloud-trace-context: 7caa9455c667772c940652d3ce03a672
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 248ms
82ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e3f84b2a779d78921849c67d98e91ee507be4fe504fc609bb4293bce0e5910e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 292
cf-ray: 9384d0cb4fd552ad-LAX
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 30 Apr 2025 05:51:31 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
113 B 289ms
121ms Image
image/gif 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&halo_id=060ixedju6a659beecie6bjh8d6bhgefgf6uomkwi0e0y6gmmium0gws4k0gsqmoq
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cb48a32f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 404ms
132ms Image
text/html 52.88.214.80
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001745992793-IN2JX20L-L07W
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.88.214.80 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-88-214-80.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745992793-IN2JX20L-L07W&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745992793-IN2JX20L-L07W&adnxs_id=653825730586760042&gdpr=0

43 B
95 B

157ms
128ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745992793-IN2JX20L-L07W&adnxs_id=653825730586760042&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cb48aa2f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001745992793-IN2JX20L-L07W&adnxs_id=653825730586760042&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 95f68ef3-af93-40d7-90e4-2a02b0ee0938
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 05:59:52 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001745992793-IN2JX20L-L07W%26auid%3DAU...
https://ids.ad.gt/api/v1/openx?openx_id=9c318fe6-f4b4-4151-a90d-91d6ad2fca36&id=AU1D-0100-001745992793-IN2JX20L-L07W&auid=AU1D-0100-001745992793-IN2JX20L-L07W

43 B
95 B

114ms
113ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=9c318fe6-f4b4-4151-a90d-91d6ad2fca36&id=AU1D-0100-001745992793-IN2JX20L-L07W&auid=AU1D-0100-001745992793-IN2JX20L-L07W
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cbc9292f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=9c318fe6-f4b4-4151-a90d-91d6ad2fca36&id=AU1D-0100-001745992793-IN2JX20L-L07W&auid=AU1D-0100-001745992793-IN2JX20L-L07W
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001745992793-IN2JX20L-L07W
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001745992793-IN2JX20L-L07W
https://ids.ad.gt/api/v1/pbm_match?pbm=2CE43D09-E787-4EA4-BBBB-43A8A771D313&id=AU1D-0100-001745992793-IN2JX20L-L07W

43 B
95 B

116ms
116ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=2CE43D09-E787-4EA4-BBBB-43A8A771D313&id=AU1D-0100-001745992793-IN2JX20L-L07W
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cdabcd2f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=2CE43D09-E787-4EA4-BBBB-43A8A771D313&id=AU1D-0100-001745992793-IN2JX20L-L07W
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:53 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001745992793-IN2JX20L-L07W&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&rub=MA3J10E5-2-7OJK&gdpr=0

43 B
95 B

120ms
120ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&rub=MA3J10E5-2-7OJK&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cd8b932f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&rub=MA3J10E5-2-7OJK&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001745992793-IN2JX20L-L07W&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=5f3c15fa-5ad5-4cf0-a921-067639c86658&id=AU1D-0100-001745992793-IN2JX20L-L07W

43 B
95 B

193ms
124ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=5f3c15fa-5ad5-4cf0-a921-067639c86658&id=AU1D-0100-001745992793-IN2JX20L-L07W
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cb48a72f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=5f3c15fa-5ad5-4cf0-a921-067639c86658&id=AU1D-0100-001745992793-IN2JX20L-L07W
content-length: 259
date: Wed, 30 Apr 2025 05:59:52 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001745992793-IN2JX20L-L07W&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001745992793...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001745992793-IN2JX20L-L07W&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001745...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=f85094d7-8c76-4084-b66c-3b8bee269f47%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5f3c15fa-5ad5-4cf0-a921-067639c86658&ttd_puid=f85094d7-8c76-4084-b66c-3b8bee269f47%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&tapad_id=f85094d7-8c76-4084-b66c-3b8bee269f47

43 B
95 B

126ms
125ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&tapad_id=f85094d7-8c76-4084-b66c-3b8bee269f47
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cdabca2f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&tapad_id=f85094d7-8c76-4084-b66c-3b8bee269f47
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Wed, 30 Apr 2025 05:59:53 GMT
server: Jetty(11.0.25)

GET
H3 200 pixel
cm.g.doubleclick.net/ 170 B
188 B 152ms
150ms Image
image/png 142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001745992793-IN2JX20L-L07W

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:52 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001745992793-IN2JX20L-L07W
https://ids.ad.gt/api/v1/amo_match?turn_id=7107673749872378488&id=AU1D-0100-001745992793-IN2JX20L-L07W

43 B
95 B

150ms
122ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=7107673749872378488&id=AU1D-0100-001745992793-IN2JX20L-L07W
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cb48a42f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=7107673749872378488&id=AU1D-0100-001745992793-IN2JX20L-L07W
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 05:59:42 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&uid=3f4e4dee-0f32-400b-b00c-9bcd7f137c27&gdpr=0

43 B
118 B

122ms
122ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&uid=3f4e4dee-0f32-400b-b00c-9bcd7f137c27&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0ccdab12f07-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001745992793-IN2JX20L-L07W&uid=3f4e4dee-0f32-400b-b00c-9bcd7f137c27&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 30 Apr 2025 05:59:52 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-189
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001745992793-IN2JX20L-L07W
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTk5Mjc5My1JTjJKWDIwTC1MMDdX

170 B
188 B

151ms
151ms

Image
image/png

142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTk5Mjc5My1JTjJKWDIwTC1MMDdX

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:53 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 9384d0cb48a82f07-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0NTk5Mjc5My1JTjJKWDIwTC1MMDdX
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:52 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 134ms
134ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Wed, 30 Apr 2025 06:14:52 GMT
accept-ranges: bytes
content-length: 67550
date: Wed, 30 Apr 2025 05:59:52 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 320 KB
112 KB 155ms
155ms Script
application/javascript 142.251.40.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.104 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d551c1c402ffbfe07bbc8c8f29fa0d9a2f0e232e49961f6ab599bb82fea17968

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1072:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1072:0"}],}
expires: Wed, 30 Apr 2025 05:59:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1072:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1072:0
content-length: 114451
x-xss-protection: 0
server: Google Tag Manager

OPTIONS
H2 200 dec
p.ad.gt/api/v1/ Frame 0
0 253ms
113ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/dec
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 9384d0cce9e20ff1-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:53 GMT
server: cloudflare
vary: Origin

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 292ms
112ms Preflight 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 9384d0cd2ef7092e-LAX
date: Wed, 30 Apr 2025 05:59:53 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
112 B 168ms
166ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cc0e21d7a7-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 284ms
119ms Script
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cd0b7d521a-LAX
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
server: cloudflare

POST
H2 204 dec Show response
p.ad.gt/api/v1/ 0
34 B 124ms
123ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/dec
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0cd9aa80ff1-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 481 B
245 B 116ms
115ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e995fee44efb6d17a7fb400b9776f1f02a8de29ccff950f724041d03d0fb6ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 9384d0cddffc092e-LAX
access-control-allow-origin: *
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 216ms
214ms XHR
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

3ed536ac12e7f152055f2adbea685e81e68e2c369f7eecd40f49a0f633a49308

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: application/json
vary: Origin

GET
H3 200 ad.slot. Show response
fundingchoicesmessages.google.com/f/AGSKWxV3N2lXEMALvW1PfEM5tCzV0_tFQOcpz3i3d97CgbLs04NFEuyua7UAiN1x5IeJmzRssZG9O5Tc7iMrByjLZNbaTJafi-eiPioSIygrJTnMuPFMjTOuLg3NojgMTAmxtybQhX733EVrbrRwGVx5pG6PdZp3A... 54 B
109 B 163ms
162ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV3N2lXEMALvW1PfEM5tCzV0_tFQOcpz3i3d97CgbLs04NFEuyua7UAiN1x5IeJmzRssZG9O5Tc7iMrByjLZNbaTJafi-eiPioSIygrJTnMuPFMjTOuLg3NojgMTAmxtybQhX733EVrbrRwGVx5pG6PdZp3Albbg0i7OR3z10FoDEeQcpDhBxX1i3KJ/_-adcentre./ad-468-/ad-utilities./sample300x250ad./ad.slot.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.JicVSDHi2hU.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwq3Q97UOg5poK2v0pfLNMQLWuccQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

05e8853b1151383551e443ab28c960433f464cb0ea55b5de921fed04f95f40c5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_mW6sfB0gkFtTHt-uY5cQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw05BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GRds_EW61YgbtK-zdoFxELcHDd_HDvAJvDi6i8lJY2k_ML45Py8kqLMpNKS_KK05LTU4tSistSieCMDI1MDEyNzPQOD-AIDAHCFPBI"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_mW6sfB0gkFtTHt-uY5cQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 291ms
136ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.JicVSDHi2hU.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwq3Q97UOg5poK2v0pfLNMQLWuccQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d1e246486f5b83490b366d4d5f9eed0e72425ce3d6b997d3a331cbb047e161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 6293792072184911421
age: 444
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 06:52:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 30 Apr 2025 05:52:29 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80731
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUjUPo4eWNfg-VMdAl5a99kL3yvTbHaZqO6A4PTgFQtJJQcqHf8TDqAznJXtVQaDTPypqvybSH35R1Kkt9jLTVwXxfGlF_bk4DF_gXu_TVmyH1ZsPUsfor2H5LForuvXWP9PNU0-Q== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 303ms
159ms XHR
text/html 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUjUPo4eWNfg-VMdAl5a99kL3yvTbHaZqO6A4PTgFQtJJQcqHf8TDqAznJXtVQaDTPypqvybSH35R1Kkt9jLTVwXxfGlF_bk4DF_gXu_TVmyH1ZsPUsfor2H5LForuvXWP9PNU0-Q==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QlF2DO1K8mE6kWLcA7YmYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw05Bi-FB_mfUHEAtxc9z8cewAm8CK_d9TlFyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRuZ6BeXyBAQCD-yUG"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QlF2DO1K8mE6kWLcA7YmYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=653825730586760042

86 B
585 B

153ms
152ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=653825730586760042

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 9384d0ce3d10ef78-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: image/png
vary: Origin
server: cloudflare
priority: u=3,i

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=653825730586760042
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a461add6-0438-4cc7-9668-2754de7a90a0
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 05:59:53 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUjUPo4eWNfg-VMdAl5a99kL3yvTbHaZqO6A4PTgFQtJJQcqHf8TDqAznJXtVQaDTPypqvybSH35R1Kkt9jLTVwXxfGlF_bk4DF_gXu_TVmyH1ZsPUsfor2H5LForuvXWP9PNU0-Q==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-LLojPnX7HzEy8x_mgzaJfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1JBi-FB_mfUHEAtxc9z8cewAm8CEC5fzlVyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGpgYmRuZ6BeXyBAQB1_iTZ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-LLojPnX7HzEy8x_mgzaJfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

9.gif
id5-sync.com/c/483/1242/0/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*1RJcW-Eed4SodNtclok_EnEtNBCjhUE15GhDx_OTrl8UCAx_BVvBncSJAQ2De7Hl&gdpr_consent=undefined&gdpr=false
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F7%2F2.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/429/7/2.gif?puid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-185bBTQevUxesmVyo1YrlQddKUevKAwAQir-F7nHZg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F6%2F3.gif%3Fpuid%3...
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-185bBTQevUxesmVyo1YrlQddKUevKAwAQir-F7nHZg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F6%2F3.gif%3F...
https://id5-sync.com/cq/483/124/6/3.gif?puid=bdb33107-88ac-4065-9a78-888cc717da7b&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F5%2F4.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/5/4.gif?puid=39275bc3-a5f3-42e5-bafd-7ec89bb64e18&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F4%2F5.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/4/5.gif?puid=u_fb6fb350-ba53-4d66-a5d0-a85913c6548d&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=5f3c15fa-5ad5-4cf0-a921-067639c86658&ttl=%%TTL%%
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F2%2F7.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/2/7.gif?puid=f85094d7-8c76-4084-b66c-3b8bee269f47&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F796%2F1%2F8.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/483/796/1/8.gif?puid=56e2f9e2-4c3d-4d99-83cc-f01407670b97&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=58&3pid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1242%2F0%2F9.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://ce.lijit.com/merge?pid=58&3pid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1242%2F0%2F9.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1242/0/9.gif?puid=KlMnALZHbcp9-ac9TaCjXSZ9&gdpr=0&gdpr_consent=

43 B
1 KB

215ms
214ms

Image
image/gif

162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/c/483/1242/0/9.gif?puid=KlMnALZHbcp9-ac9TaCjXSZ9&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 05:59:58 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://id5-sync.com/c/483/1242/0/9.gif?puid=KlMnALZHbcp9-ac9TaCjXSZ9&gdpr=0&gdpr_consent=
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:58 GMT
vary: Accept-Encoding

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 298ms
152ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 8C8A 5 KB
2 KB 260ms
94ms Document
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 2900
apigw-requestid: J0hXZicqvHcEPEg=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9384d0cfaa277cda-LAX
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 05:59:53 GMT
last-modified: Wed, 30 Apr 2025 05:04:34 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

POST
H2 204 collect
analytics.google.com/g/ 0
0 249ms
95ms Fetch
text/plain 2001:4860:4802:38::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-FVWZ0RM4DH&gtm=45je54s1v9116367008za200&_p=1745992792924&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004&cid=132795969.1745992791&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&uid=AU1D-0100-001745992793-IN2JX20L-L07W&sid=1745992793&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_ss=1&_ee=1&ep.dimension3=403&ep.dimension4=paint.toys&ep.dimension5=%2Foil%2F&ep.dimension7=edcc42ebc2b19550d2248e1d537f3ab2&tfd=4341
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
553 B 408ms
138ms Ping
text/plain 2607:f8b0:4004:c06::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-FVWZ0RM4DH&cid=132795969.1745992791&gtm=45je54s1v9116367008za200&aip=1&uid=AU1D-0100-001745992793-IN2JX20L-L07W&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c06::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:122:0
report-to: {"group":"ascnsrsggc:122:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:122:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:122:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: text/plain
server: Golfe2

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 4971
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

269 B
379 B

432ms
134ms

Document
text/html

23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 30 Apr 2025 05:59:54 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 30 Apr 2025 05:59:53 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
server: AkamaiGHost

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUjUPo4eWNfg-VMdAl5a99kL3yvTbHaZqO6A4PTgFQtJJQcqHf8TDqAznJXtVQaDTPypqvybSH35R1Kkt9jLTVwXxfGlF_bk4DF_gXu_TVmyH1ZsPUsfor2H5LForuvXWP9PNU0-Q==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Jh9WkEClS7oxCZaTGM9yXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw05Bi-FB_mfUHEAvxcNz8cewAm8CO6RPnMSm5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI3M9A_P4AgMAehkkvQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Jh9WkEClS7oxCZaTGM9yXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUjUPo4eWNfg-VMdAl5a99kL3yvTbHaZqO6A4PTgFQtJJQcqHf8TDqAznJXtVQaDTPypqvybSH35R1Kkt9jLTVwXxfGlF_bk4DF_gXu_TVmyH1ZsPUsfor2H5LForuvXWP9PNU0-Q==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9BqW4K5TN9VD6OvdHOU5-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII0pBi-FB_mfUHEAvxcNz8cewAm8CF2RPmMim5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTI3M9A_P4AgMAhjgk4w"
content-security-policy: script-src 'report-sample' 'nonce-9BqW4K5TN9VD6OvdHOU5-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXQycl4ZZthMURXJnNKYn5xw4Gtxxzz_w-qeKbj3qzWSS-4El9H4DBJCC0_hRlqdh371cKjP8eHdWQmen1VMp5AZq9ZsBQ-74752R8hSkSqiHhYAMKRsOsRmxd15bpTzVc1Tuyu1A== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 176ms
175ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXQycl4ZZthMURXJnNKYn5xw4Gtxxzz_w-qeKbj3qzWSS-4El9H4DBJCC0_hRlqdh371cKjP8eHdWQmen1VMp5AZq9ZsBQ-74752R8hSkSqiHhYAMKRsOsRmxd15bpTzVc1Tuyu1A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1OTkyNzkzLDUxODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJKaWNWU0RIaTJoVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJ3eHFkei56ZXJyYXNvZnQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

878171fadf65dd7c792590bd5d4a6ce17748efec5c4373d780d8400629b49f1d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3hUTNlNlQTPVxkvPCqS4SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw1JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYhj026ypgJx796brDeO3GTdtfEW62EgbtK-zdoFxEI8HDd_HDvAJnDj5MmlTEoaSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRfFGBkamBiZG5noGBvEFBgCsjDxi"
content-security-policy: script-src 'report-sample' 'nonce-3hUTNlNlQTPVxkvPCqS4SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 118ms
117ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 9384d0d11f1e0ff1-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:53 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 115ms
115ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 9384d0d05e4d0ff1-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:53 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame 8C8A 0
140 B 276ms
131ms Ping
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 9384d0d2ee280fbd-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Wed, 30 Apr 2025 05:59:54 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 262ms
120ms Preflight
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 9384d0d13c852a93-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:53 GMT
server: cloudflare
vary: Origin

POST
H3 204 AGSKWxXSdDA7FwmZWMWR_XTwneE7aXZRh9WAlNcOkxdzKASNv5s3ci83DmnvUMyM9JUMo9LZqEY07vLIBedZ6AXeATOQzUcIsG7L7h_uJMxZ_T-849jn89hrfz90y2NRdhzt4nyh5hsDew== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 161ms
159ms XHR
text/html 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXSdDA7FwmZWMWR_XTwneE7aXZRh9WAlNcOkxdzKASNv5s3ci83DmnvUMyM9JUMo9LZqEY07vLIBedZ6AXeATOQzUcIsG7L7h_uJMxZ_T-849jn89hrfz90y2NRdhzt4nyh5hsDew==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Jsk7VMSdMmJKpqtoh4_Uaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw05Bi-FB_mfUHEAvxcNz8cewAm8CG_w1fmZRckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGJkbmegXl8gQEArHAlaw"
content-security-policy: script-src 'report-sample' 'nonce-Jsk7VMSdMmJKpqtoh4_Uaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 41 KB
8 KB 747ms
747ms Fetch
text/plain 142.251.40.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3967996822367994&correlator=1038601364524076&eid=31091864%2C31091881%2C31092019%2C31092037%2C83321073%2C31086810&output=ldjh&gdfp_req=1&vrg=202504280101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745992793964&lmt=1745992793&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1KkxDMHZpaGdoQkZWUlM2aU5iN1pNdzRnU1I4RmF1akxrSFZjd0ZncXMzWTRVQ01kcGV5WFByMmZWenVxSjAzTy1YARI0CgpwdWJjaWQub3JnEiQ4NTcwNTM3My1lNThhLTRiZjAtODE5NS05ZDQ0NzdiODRjZTRYARI3Cg1iaWRzd2l0Y2gubmV0EiQwNGM4NjZkOS1lNjgxLTRiNmUtYjk3MS0xZmU3YTc1MWMxZWFYARInChJydWJpY29ucHJvamVjdC5jb20SD0tHMThPVFVRLVEtQk00M1gBEj4KHGxpdmVpbnRlbnQuaW5kZXhleGNoYW5nZS5jb20SHFgzOXViTkhNNkdrQUFIQ3NneElBQUFBUyYxNThYARI2CgxwdWJtYXRpYy5jb20SJDMwN0M5QUE3LTJDMUItNDQ2Mi1CNjI5LUVDNUI5RTU4NjBBRVgBEh0KDmVzcC5jcml0ZW8uY29tGLvvnqroMkgAUgIIZBIYCgl5YWhvby5jb20Y9vKequgySABSAghvEu4BCghydGJob3VzZRLYAUxBMEhtcVorYktCbEUvYnZuQVlkYWJOR2RFOUlzUWRkdmhxT25EblpOWW9oZnhkSk9EZG9SUExOOG9yblVnbnZja0owNHBQNWFhdFRvdDMxL1dac25rblpuTU9BQ3BzTWlLK3QxZWRhNzIyYm5zWkdBNVhuNnJCRTBYeEwxTURQeEJidXBZTlZnMWZrbkxGaUxBKy9KUnZ2WXYzWU1ndnkwYWdkYnJCMWlJeFJRVVJicmlmNDA4T0JMK1FKQ2xIei9PRUFjRFZMU21PSnoyY1RxS1hTZFE9PRjd9p6q6DJIABIUCgVvcGVueBio8Z6q6DJIAFICCG8SGwoMMzNhY3Jvc3MuY29tGLvvnqroMkgAUgIIZBIzCglvcGVueC5uZXQSJDNiMzA5MWJkLWE3ZWYtNDAyZi1iZjc2LWU0NTU2Mzc3Y2VhZVgBEocBCg5saXZlaW50ZW50LmNvbRJzMTQtbDF0VmlLMjk1WFNzZDRtNEdJTUlNYlI0bzZqQkFveWVkS0hQdXZzcTlrQTBHREdPTUNqRlI5VzJBam5yMHM2TlR2RUM2NTF2WkhWQldSNXF0N3FJelZURVBRUUN3ckl2UGFvcUZBK1pTbnVSS1E9PVgBEjMKGWxpdmVpbnRlbnQudHJpcGxlbGlmdC5jb20SFDE3Mzk0Mzg5NTE4MjQ3NTcxOTc5WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745992789763&idt=1420&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D69ab9d12cddd4ceb902f6d79fa2ea6c292791342%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fwxqdz.zerrasoft.com%252F%26tyche_code%3DV.20250423.1%26pageos_code%3DV.20250423.1%26config_id%3D1024872_74068_primary_config%26hour%3D19%26day%3DTuesday%26referrer_domain%3Dwxqdz.zerrasoft.com%26OS%3DLinux%2520null%26browser%3DChrome%2520135%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250423.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=48212&tan=dfeb3b14-8afa-431c-91fb-95fb5be87032&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b2cc7fb3ae1dda133da29a2244ec01e6fbc3a85344d837b3a9bc4fab54343f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: 125064
google-mediationgroup-id: 100271
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 8005
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 254A 7 KB
3 KB 312ms
149ms Document
text/html 142.251.35.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.161 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 05:59:54 GMT
expires: Wed, 30 Apr 2025 05:59:54 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 4971 44 KB
11 KB 135ms
135ms Script
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 106445ed5fad1f32e8d9e544fd2b6d889c03fe2010671d56c2e3b3866152c44b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

Response headers

cache-control: max-age=85145
content-encoding: gzip
expires: Thu, 01 May 2025 05:38:59 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11388
date: Wed, 30 Apr 2025 05:59:54 GMT
last-modified: Wed, 30 Apr 2025 05:38:59 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame A1C9 0
100 B 409ms
132ms Document
text/plain 54.200.109.170
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.200.109.170 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-200-109-170.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Wed, 30 Apr 2025 05:59:54 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H3 200 container.html Show response
804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame D569 7 KB
0 0ms
0ms Document
text/html 142.251.35.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.161 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 05:59:54 GMT
expires: Wed, 30 Apr 2025 05:59:54 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame EAB7 3 KB
2 KB 225ms
81ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 341
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 9384d0d85f197c73-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 30 Apr 2025 05:59:54 GMT
expires: Wed, 30 Apr 2025 09:59:54 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E7A1 20 KB
7 KB 135ms
134ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=21780
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Wed, 30 Apr 2025 05:59:54 GMT
expires: Wed, 30 Apr 2025 12:02:54 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame BCF6 52 KB
17 KB 741ms
220ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 61880
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 30 Apr 2025 05:59:55 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1157433, 123253
X-Served-By: cache-lga21993-LGA, cache-mad2200129-MAD
X-Timer: S1745992795.393195,VS0,VE0

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 2D09 1 KB
2 KB 395ms
141ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 38d1c24a05f1ddb2f8def04365dd5cf9a3cd8c92315b3b8c26c0677f8f9f0671

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 0537 2 KB
1 KB 373ms
124ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 05:59:54 GMT
server: Kestrel
server-processing-duration-in-ticks: 48019
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 8EB1 813 B
1 KB 105ms
94ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 8a7be02b24f0817565a86f9190d45ef0cb221c4c18567605893fff8733111262

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 813
content-type: text/html
date: Wed, 30 Apr 2025 05:59:54 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.248

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 28E1 269 B
379 B 134ms
134ms Document
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 30 Apr 2025 05:59:54 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame EFB7 11 KB
4 KB 287ms
145ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4&33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s/aFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5+tMRPp+Z7nGPqHDLO6f+RdlEg1+ecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM/nNtc3jHvvWgZV33tjXGpiN9joWm7S/ZfefrSF+3JHzWqgcOAqb966OqkwG/FGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D+VeedIoDUXyoGNzUun9J/e8n+NySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6+85yML388gCqz4+SRXESEkbgkjZseeeoBa4u65epTSTOaVmCm+5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY+9i/62iNk9W067UjCrEWkFqkzc/5xHfjPFRTo3l6DKglfhseX+VIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4+gG79x/SCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751/CkAXjGMCUv3MjqR8/0ckLAEt4jIeqiMIut73tkolu18j6+wbs7W2nWSYEQ6fYtxJuh8eI/HrDY+aHT6zU8tXVh0//W5sDZfUyPN/U+kb+cLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc/jzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB+KLoqRnp24U2Vc+UrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh/bz+kIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW/qyO2PnKOs2dGCXCz9TsE4uXrC3L+J1W4qAz12hBEIT2lTYbfhvN/64zUpIgjM4LF9C/mM+A8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn/h5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0+/Dap0Ch1dyXJSzQd/Voa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745992792011&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af9f0de0c0fd674da975cfe3a0edac5b5b855010a99b1e37b31f94fa46ab2db7

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 9384d0d86f382f10-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
expires: 0
last-modified: Tue, 22 Apr 2025 08:35:30 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 9E67 0
0 466ms
135ms Document
text/plain 198.199.91.118
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.91.118 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 132ms
129ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=ruk8819CeG1mbzFYdUJZT2IybUtueWVDc1UlMkJtRXVYbG1JJTJCR3RuRHpmUnV3ZmxXNFdPSnV4dnAybW5oaE14UWp1NXh2bGpSREtCanVCYUJZNFFNYWJMJTJGOFRVMWpJdmpZaEZLZU9GaDVVNkhHaWxpN0s2ZktWeWZpMlFKcTU2TWpvSUNaMg&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 30 Apr 2025 05:59:54 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 240493
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 215ms
213ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-34-194-238-59.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
665 B 135ms
132ms Fetch
application/javascript 34.202.85.19
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.202.85.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-85-19.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: ba04426626b6d45f6050cfe4142d45eee900ebd908a7d8101e5fb01b4d8a99a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 97ms
93ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&us_privacy=1NNY&tp=AHu3B2hm7LfQqpIQTOxaW2NjIs8d%2FELyP%2FybzZCFzM4%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: cc18c31e5a637dcdd512cbba57787eb8e867c7e03408bd8fa8d133c0fa7a3311

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 480 B
0 2ms
2ms Fetch
text/plain 54.235.141.11
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jt2mfd0farfe23jj9rb9625z&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.141.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-141-11.compute-1.amazonaws.com
Software: /
Resource Hash: f72d951da1ec82cf22de28439230e1cbca20845686924e7c298d7c31fdd423b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: f5d3ceb63156c9d9
request-time: 6
access-control-allow-credentials: true
expires: Thu, 01 May 2025 05:59:51 GMT
access-control-allow-origin: https://paint.toys
content-length: 480
date: Wed, 30 Apr 2025 05:59:51 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 129ms
127ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 266467
expires: 0
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&us_privacy=1NNY
https://p.rfihub.com/cm?in=1&pub=20513&ssp=themediagrid&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=8148574130252868296&expires=30&ssp=themediagrid

43 B
103 B

141ms
141ms

Image
image/gif

35.211.202.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=119&user_id=8148574130252868296&expires=30&ssp=themediagrid
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=119&user_id=8148574130252868296&expires=30&ssp=themediagrid
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Date: Wed, 30 Apr 2025 05:59:55 GMT
Server: Jetty(9.4.51.v20230217)

GET
H2

200

ibs:dpid=903&dpuuid=5f3c15fa-5ad5-4cf0-a921-067639c86658
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f3c15fa-5ad5-4cf0-a921-067639c86658

42 B
714 B

133ms
132ms

Image
image/gif

34.194.238.59
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f3c15fa-5ad5-4cf0-a921-067639c86658

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.194.238.59 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v076-00d5e3787.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: hRim0OJFQSg=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f3c15fa-5ad5-4cf0-a921-067639c86658
content-length: 189
date: Wed, 30 Apr 2025 05:59:55 GMT
server: Kestrel

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D569 0
0 161ms
160ms Fetch
text/html 142.251.40.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C-jfXWrwRaNDlB7KtjvQPm_TWiAqeoaGuXKH56P6fA8CNtwEQASAAYMme9oaAgKAZggEXY2EtcHViLTU4MTIzNTczNTIzMzUwNzXIAQngAgCoAwHIAwKqBOECT9BptVMaeUdkfWOVNsaKE3fA1GNCptzlJAmdSiOPzv3O9p42_TwlJYJo3c5aKDZLh16MErK6Rv_txdrbhqJFCmyHSknR1SYQWltHnOwyNA5YutZVFQS8K_bwqYG5sFXmFTUbCHsrYTitS_Jky7GUD9DDHz0pgF91o5lpFL_rOtMEJC8ZqCAC07ktBzdGV87UneSSQSXFTFWGCnsJp3kDWwNw2BrGf_Eq25I2KshmNXC363JlTiwV1IqbAfBaWntgfVzkx-CtIasfdckTNkPemEgZjHhR0k_S4B2XOowDhNmnlO3vqDt9Ot6dvxU2LtGaILeMju9Mumbzj_iTpXLpvmXqD2CyLnt4Z37NQbz2mO91tCSqBh3Qlp7AY1bsZlsw1jsl2bcr7JyWgcUOKRoRGCfSrTd6hs8qNifmF6rV-2zcO9pUwAtzy6BwZ63m-vKPh_46qJyg3UCYQ9DlPEouHnzgBAGABsWpgaWChc3b8AGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrEC2AcA0ggmCIBhEAEyAooCOg2AQIDAgICAgKiAAqABSL39wTpYtaOVgor_jAOACgP6CwIIAYAMAaoNAlVT4g0TCPHQlYKK_4wDFbKWgwgdG7oVoeoNEwivspaCiv-MAxWyloMIHRu6FaHQFQGAFwGyFyoKGhIUcHViLTU4MTIzNTczNTIzMzUwNzUY26IhGAsqCjIxODQzNjczNDY&sigh=sBlWtc_h5NA&uach_m=%5BUACH%5D&cid=CAQSOwDZpuyzPdZj3EhNJglveskN56H0-38xDakx7mMM7sGBoEBq32Jp-2nntB3lDVWPt_B2msrDaaQKVkpNGAE
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s79-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame D569 17 KB
8 KB 457ms
135ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44798d078224b9495181c7fa670e99acbc297f61637d5500810503a262c8a5fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 803
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 06:46:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:46:32 GMT
last-modified: Tue, 29 Apr 2025 13:37:20 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 7404
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK ar.js Show response
a.rfihub.com/bn/ Frame D569 4 KB
5 KB 460ms
140ms Script
application/javascript 199.38.167.131
ROCKETFUEL

General

Check archive.org

Download Go to

Full URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.38.167.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 6046b563f58ef685eddbd642da3f5fa7dbb95f170907ae221870560c5f22cc62

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 4196
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: application/javascript;charset=iso-8859-1
Server: Jetty(9.4.51.v20230217)

GET
H/1.1 200
OK 10acf955-f531-45f9-91fa-b4f555629364
a1514.casalemedia.com/impression/v2/249611/192/d08romijfn3uhs7319c0/ Frame D569 43 B
303 B 454ms
137ms Image
image/gif 209.204.239.204
CASALE-MEDIA

General

Check archive.org

Download Go to Show image

Full URL: https://a1514.casalemedia.com/impression/v2/249611/192/d08romijfn3uhs7319c0/10acf955-f531-45f9-91fa-b4f555629364?verifieD=1&userID=&cmpro=0&deviceType=2&expiryTime=1745993394&profileIDs=&creativeID=344c7bf&pubID=186779&format=banner&channel=site&ap=aBG8WgAB8tAIg5ayABW6G1LwebIc4iBCuDOPuA&ee=1
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.204.239.204 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Expires: 0
Access-Control-Allow-Origin: *
Content-Length: 43
Keep-Alive: timeout=1, max=500
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: image/gif
Server: Apache

GET
H/1.1 200
OK mbk.gif
ewr-529.ewr-rtb1.rfihub.com/bn/ Frame D569 42 B
729 B 604ms
143ms Image
image/gif 199.38.167.152
ROCKETFUEL

General

Check archive.org

Download Go to Show image

Full URL: https://ewr-529.ewr-rtb1.rfihub.com/bn/mbk.gif?aeh=0&ai=5840043&bt=1745992794271&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&dc=3&di=&ep=aBG8WgAAAAA5kc401EZn5O-ca7xmbP5YWDDNFA&h=600&pe=https%3A%2F%2Fpaint.toys%2Foil&ra=9927942710.9174825872112202&rb=2079&re=37545&ri=c8d5147f2bc4d0cc021360097c1261e1&rt=2103387&ug=249611&w=160
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.152 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-cache
Content-Length: 42
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: image/gif
Server: Jetty(9.4.51.v20230217)

GET
H2 204 ci
k8s1-event-tracker-va.lb.indexww.com/event/ Frame D569 0
104 B 449ms
133ms Image
text/plain 209.204.228.127
CASALE-MEDIA

General

Check archive.org

Download Go to Show image

Full URL

https://k8s1-event-tracker-va.lb.indexww.com/event/ci?bi=10acf955-f531-45f9-91fa-b4f555629364&bs=160x600&c=54839231&campid=7476330&cid=5840043&d=192&dab=paint.toys&ec=31&ee=1&f=1&i=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&p=186779&pr=0.24&s=249611&tx=d08romijfn3uhs7319c0

Requested by

Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

209.204.228.127 , Canada, ASN27381 (CASALE-MEDIA, CA),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

date: Wed, 30 Apr 2025 05:59:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250428/r20110914/client/ Frame D569 3 KB
1 KB 476ms
157ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250428/r20110914/client/window_focus_fy2021.js

Requested by

Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14145566667870440924
age: 55986
x-content-type-options: nosniff
expires: Tue, 13 May 2025 14:26:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 29 Apr 2025 14:26:49 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250428/r20110914/client/ Frame D569 19 KB
8 KB 457ms
138ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250428/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d35c18c2b29d1e54ca090590ec052e8b25a024befca83889d9423340a9b53252

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14062705138371556491
age: 55986
x-content-type-options: nosniff
expires: Tue, 13 May 2025 14:26:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 29 Apr 2025 14:26:49 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7939
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame D569 0
0

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-41/js/ Frame D569 25 KB
7 KB 476ms
158ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-41/js/ext.js

Requested by

Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7545b5d8b366cf7960d74ef16f2c98425f17d34a392e909bdf5fa53f340b134

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 05:59:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6870
x-xss-protection: 0
server: sffe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame D569 220 KB
68 KB 281ms
138ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

0923ca035ce2e912178eb2032b148668aa905613119db6bf7a16df9178b54eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 360109090404770869
age: 166
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 06:57:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 30 Apr 2025 05:57:09 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69331
x-xss-protection: 0
server: cafe

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame D64B 0
412 B 556ms
131ms Document
text/html 3.225.105.31
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.105.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-105-31.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Wed, 30 Apr 2025 05:59:55 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 8EB1
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=653825730586760042

43 B
61 B

72ms
71ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=653825730586760042
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=653825730586760042
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7e9277a8-9663-4016-9a0c-a97d5785f63a
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 8EB1
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=e0b7e9e5-b07f-48cd-a58f-057583cb64ea
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=e0b7e9e5-b07f-48cd-a58f-057583cb64ea

42 B
319 B

119ms
118ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=e0b7e9e5-b07f-48cd-a58f-057583cb64ea
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=e0b7e9e5-b07f-48cd-a58f-057583cb64ea
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 8EB1 95 B
768 B 246ms
98ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=b30fe57f-263f-432a-b017-1d5089dcc43e

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 8EB1
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&gdpr=0&gdpr_consent=

43 B
61 B

72ms
72ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 8EB1
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=dc19f4ae-f0e6-46d1-bf6f-48f2e2a87bc5

43 B
61 B

96ms
95ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=dc19f4ae-f0e6-46d1-bf6f-48f2e2a87bc5
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: 5f4ca24e-a62f-4dd3-9174-d036e217da48
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=dc19f4ae-f0e6-46d1-bf6f-48f2e2a87bc5
Content-Length: 112
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame 8EB1
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=aiccv9S-x4McgskxaUk_iA==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

99ms
95ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 28E1 44 KB
0 135ms
135ms Script
text/html 23.41.170.143
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.170.143 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-170-143.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 106445ed5fad1f32e8d9e544fd2b6d889c03fe2010671d56c2e3b3866152c44b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=85145
content-encoding: gzip
expires: Thu, 01 May 2025 05:38:59 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11388
date: Wed, 30 Apr 2025 05:59:54 GMT
last-modified: Wed, 30 Apr 2025 05:38:59 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame E7A1 5 KB
6 KB 385ms
128ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=35430328&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: cbd582d1f95bc6a0f9419fd3293a0e9d7a77436a1d85d2f43a0e2c0df8c5bdc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 155ms
153ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504280101/pubads_impl.js?cb=31092037
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 215ms
214ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

f9644de09906ff7b61ff5216efd323a7f59c4a43554522fb3ad5149b483fb7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 4971 7 B
1 KB 506ms
127ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame EFB7 19 KB
7 KB 322ms
103ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4&33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s/aFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5+tMRPp+Z7nGPqHDLO6f+RdlEg1+ecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM/nNtc3jHvvWgZV33tjXGpiN9joWm7S/ZfefrSF+3JHzWqgcOAqb966OqkwG/FGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D+VeedIoDUXyoGNzUun9J/e8n+NySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6+85yML388gCqz4+SRXESEkbgkjZseeeoBa4u65epTSTOaVmCm+5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY+9i/62iNk9W067UjCrEWkFqkzc/5xHfjPFRTo3l6DKglfhseX+VIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4+gG79x/SCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751/CkAXjGMCUv3MjqR8/0ckLAEt4jIeqiMIut73tkolu18j6+wbs7W2nWSYEQ6fYtxJuh8eI/HrDY+aHT6zU8tXVh0//W5sDZfUyPN/U+kb+cLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc/jzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB+KLoqRnp24U2Vc+UrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh/bz+kIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW/qyO2PnKOs2dGCXCz9TsE4uXrC3L+J1W4qAz12hBEIT2lTYbfhvN/64zUpIgjM4LF9C/mM+A8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn/h5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0+/Dap0Ch1dyXJSzQd/Voa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745992792011&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 9384d0dabfe32b8f-LAX
access-control-allow-origin: *
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame EFB7 4 KB
1 KB 152ms
150ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4&33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s/aFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5+tMRPp+Z7nGPqHDLO6f+RdlEg1+ecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM/nNtc3jHvvWgZV33tjXGpiN9joWm7S/ZfefrSF+3JHzWqgcOAqb966OqkwG/FGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D+VeedIoDUXyoGNzUun9J/e8n+NySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6+85yML388gCqz4+SRXESEkbgkjZseeeoBa4u65epTSTOaVmCm+5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY+9i/62iNk9W067UjCrEWkFqkzc/5xHfjPFRTo3l6DKglfhseX+VIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4+gG79x/SCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751/CkAXjGMCUv3MjqR8/0ckLAEt4jIeqiMIut73tkolu18j6+wbs7W2nWSYEQ6fYtxJuh8eI/HrDY+aHT6zU8tXVh0//W5sDZfUyPN/U+kb+cLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc/jzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB+KLoqRnp24U2Vc+UrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh/bz+kIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW/qyO2PnKOs2dGCXCz9TsE4uXrC3L+J1W4qAz12hBEIT2lTYbfhvN/64zUpIgjM4LF9C/mM+A8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn/h5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0+/Dap0Ch1dyXJSzQd/Voa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745992792011&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dc6af6e6c723acb427ffb2255141b3bc20d11d7994eaae5bc1f656f5286b7fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4&33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s/aFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5+tMRPp+Z7nGPqHDLO6f+RdlEg1+ecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM/nNtc3jHvvWgZV33tjXGpiN9joWm7S/ZfefrSF+3JHzWqgcOAqb966OqkwG/FGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D+VeedIoDUXyoGNzUun9J/e8n+NySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6+85yML388gCqz4+SRXESEkbgkjZseeeoBa4u65epTSTOaVmCm+5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY+9i/62iNk9W067UjCrEWkFqkzc/5xHfjPFRTo3l6DKglfhseX+VIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4+gG79x/SCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751/CkAXjGMCUv3MjqR8/0ckLAEt4jIeqiMIut73tkolu18j6+wbs7W2nWSYEQ6fYtxJuh8eI/HrDY+aHT6zU8tXVh0//W5sDZfUyPN/U+kb+cLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc/jzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB+KLoqRnp24U2Vc+UrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh/bz+kIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW/qyO2PnKOs2dGCXCz9TsE4uXrC3L+J1W4qAz12hBEIT2lTYbfhvN/64zUpIgjM4LF9C/mM+A8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn/h5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0+/Dap0Ch1dyXJSzQd/Voa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745992792011&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9384d0d968222f10-LAX
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 217ms
215ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

d837ae7b2adc909db811a454181a3ae5abe70734fd83dba1b69ecb855c54c19c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: application/json
vary: Origin

GET
H2 200 PrebidServer
crb.kargo.com/api/v1/dsync/ Frame EFB7 43 B
369 B 442ms
132ms Image
image/gif 18.233.32.243
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/PrebidServer?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dkargo%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4&33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s/aFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5+tMRPp+Z7nGPqHDLO6f+RdlEg1+ecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM/nNtc3jHvvWgZV33tjXGpiN9joWm7S/ZfefrSF+3JHzWqgcOAqb966OqkwG/FGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D+VeedIoDUXyoGNzUun9J/e8n+NySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6+85yML388gCqz4+SRXESEkbgkjZseeeoBa4u65epTSTOaVmCm+5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY+9i/62iNk9W067UjCrEWkFqkzc/5xHfjPFRTo3l6DKglfhseX+VIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4+gG79x/SCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751/CkAXjGMCUv3MjqR8/0ckLAEt4jIeqiMIut73tkolu18j6+wbs7W2nWSYEQ6fYtxJuh8eI/HrDY+aHT6zU8tXVh0//W5sDZfUyPN/U+kb+cLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc/jzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB+KLoqRnp24U2Vc+UrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh/bz+kIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW/qyO2PnKOs2dGCXCz9TsE4uXrC3L+J1W4qAz12hBEIT2lTYbfhvN/64zUpIgjM4LF9C/mM+A8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn/h5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0+/Dap0Ch1dyXJSzQd/Voa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745992792011&bidder=ozone
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.233.32.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-32-243.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 43
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif
vary: Origin
x-accel-expires: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame 2D09
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=5f3c15fa-5ad5-4cf0-a921-067639c86658&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
476 B

147ms
145ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=5f3c15fa-5ad5-4cf0-a921-067639c86658&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=5f3c15fa-5ad5-4cf0-a921-067639c86658&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Wed, 30 Apr 2025 05:59:55 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 2D09 170 B
232 B 155ms
151ms Image
image/png 142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D09
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkwMjAxNTQ4MjQ0NDc2NDQ4Mjc5OA%3D%3D

170 B
188 B

154ms
152ms

Image
image/png

142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkwMjAxNTQ4MjQ0NDc2NDQ4Mjc5OA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkwMjAxNTQ4MjQ0NDc2NDQ4Mjc5OA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:55 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 2D09
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkwMjAxNTQ4MjQ0NDc2NDQ4Mjc5OA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

142ms
141ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 2D09 0
249 B 409ms
135ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2902015482444764482798&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 19BED35CBE034692B2CD55B849508586 Ref B: LAX311000110023 Ref C: 2025-04-30T05:59:55Z
x-li-fabric: prod-lor1
x-li-uuid: AAYz+KBcgoQfPekU/Zpgpg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame 2D09
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=2902015482444764482798
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=5f3c15fa-5ad5-4cf0-a921-067639c86658
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=5f3c15fa-5ad5-4cf0-a921-067639c86658

43 B
576 B

556ms
131ms

Image
image/gif

2600:1f18:ed:550f:aa6e:8f5f:5607:43b0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=5f3c15fa-5ad5-4cf0-a921-067639c86658

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

HTTP/1.1

Server

2600:1f18:ed:550f:aa6e:8f5f:5607:43b0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 7de8d044e427e4bd
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Wed, 30 Apr 2025 05:59:56 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=5f3c15fa-5ad5-4cf0-a921-067639c86658
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:55 GMT
trace-id: 1b9422ef4442bd7a
Request-Time: 0
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 2D09
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2902015482444764482798?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-9jfTiw9E2oScWZJuiWI8j_caQOrUTmpj8XJsoKZxyg--~A&dongle=0883

37 B
476 B

144ms
144ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-9jfTiw9E2oScWZJuiWI8j_caQOrUTmpj8XJsoKZxyg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-9jfTiw9E2oScWZJuiWI8j_caQOrUTmpj8XJsoKZxyg--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 2D09 42 B
692 B 372ms
100ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2902015482444764482798&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "ee17fc9b49b5db1:0"
x-msedge-ref: Ref A: 246D68804D944CB9A660A1CB9B0B219E Ref B: LAX311000110033 Ref C: 2025-04-30T05:59:55Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: image/gif
last-modified: Thu, 24 Apr 2025 18:49:29 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 2D09
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=7a1ab7a031e31307&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAGRslC7KQ-ZAJwVXc3AQEBAQEBAQCXhEbGAAEBAQEBAQEB&expiration=1746079195&is_secure=true&gdpr_consent=&gdpr=0

37 B
476 B

144ms
143ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAGRslC7KQ-ZAJwVXc3AQEBAQEBAQCXhEbGAAEBAQEBAQEB&expiration=1746079195&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAGRslC7KQ-ZAJwVXc3AQEBAQEBAQCXhEbGAAEBAQEBAQEB&expiration=1746079195&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 2D09
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430

37 B
476 B

146ms
142ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430
Content-Length: 141
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 impl_v105.js Show response
www.googletagservices.com/dcm/ Frame D569 68 KB
26 KB 139ms
137ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v105.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb6988f24a0e19064f2ac7189c4f31560dbe71def169241a739a812d9f72f50a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 539401
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 00:09:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Apr 2025 00:09:54 GMT
last-modified: Mon, 10 Mar 2025 13:27:01 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 26462
x-xss-protection: 0
server: sffe

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 2D6F
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=

35 B
591 B

136ms
135ms

Document
image/gif

185.167.164.48
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Wed, 30 Apr 2025 05:59:55 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 9E30
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=2CE43D09-E787-4EA4-BBBB-43A8A771D313&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=2CE43D09-E787-4EA4-BBBB-43A8A771D313&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

305ms
154ms

Document
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=2CE43D09-E787-4EA4-BBBB-43A8A771D313&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 30 Apr 2025 05:59:55 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: BE33TQXMM4VW3QEJ2SM0

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:55 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=2CE43D09-E787-4EA4-BBBB-43A8A771D313&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: A4HSMRB2YESWFMN3F96N

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7088
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=653825730586760042&gdpr=0&gdpr_consent=

42 B
447 B

340ms
127ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=653825730586760042&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 15976875-571b-40a6-8566-ec1dca21ee56
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=653825730586760042&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.248; 162.245.206.248; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 028C 0
340 B 430ms
133ms Document
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame D8EE
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=1gDT-guW2Rvz8jHxxaJ3HR7G3vJPZVKjFqnKmQrdtCuZnAE&gdpr=0&gdpr_consent=

42 B
368 B

127ms
127ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=1gDT-guW2Rvz8jHxxaJ3HR7G3vJPZVKjFqnKmQrdtCuZnAE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 208
Content-Type: text/html; charset=utf-8
Date: Wed, 30 Apr 2025 05:59:55 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=1gDT-guW2Rvz8jHxxaJ3HR7G3vJPZVKjFqnKmQrdtCuZnAE&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame 8611
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDOHNFN1FJM2tBQUZLcFR0MlFFZw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AABMLE7QI3kAAFNGzYeRVg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1640687356149475181&gdpr=0&gdpr_consent=

43 B
433 B

131ms
130ms

Document
image/gif

3.212.167.157
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1640687356149475181&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.212.167.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-212-167-157.compute-1.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Wed, 30 Apr 2025 05:59:56 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

cache-control: no-cache,no-store
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1640687356149475181&gdpr=0&gdpr_consent=
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma: no-cache

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 0753
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
153 B

217ms
217ms

Document
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aBG8WwANiOrFeABh
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1466
cache-control: no-cache
content-length: 85
content-type: image/png
date: Wed, 30 Apr 2025 05:59:55 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 6742
x-robots-tag: noindex
x-served-by: cache-mad22057-MAD
x-timer: S1745992796.773239,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aBG8WwANiOrFeABh
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-mad22057-MAD
x-timer: S1745992795.467880,VS0,VE87

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 43F4
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=8148574130252868296

42 B
195 B

136ms
135ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=8148574130252868296
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:55 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=8148574130252868296
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9C71
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=5543a60e-e1c5-4845-9c71-a343412086e7&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=5543a60e-e1c5-4845-9c71-a343412086e7&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=f84c194b-bffb-4c11-973d-3b9fa0ab5ce9&ssp=pubmatic&expires=30&user_group=5&bsw_param=5543a60e-e1c5-4845-9c71-a343412086e7
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5543a60e-e1c5-4845-9c71-a343412086e7&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
282 B

129ms
128ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5543a60e-e1c5-4845-9c71-a343412086e7&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:56 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5543a60e-e1c5-4845-9c71-a343412086e7&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame F1DE
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=ac80a2be-7066-4724-9be5-5c47b4e96d0c&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=2CE43D09-E787-4EA4-BBBB-43A8A771D313

42 B
489 B

130ms
130ms

Document
image/gif

18.210.62.131
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=2CE43D09-E787-4EA4-BBBB-43A8A771D313
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.62.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-62-131.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Wed, 30 Apr 2025 05:59:56 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 30 Apr 2025 05:59:55 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=2CE43D09-E787-4EA4-BBBB-43A8A771D313
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 5B16
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=bUzapjkX3vV2FY32P0zG9j9FivJ2TYinbBcaqg8g

42 B
418 B

136ms
135ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=bUzapjkX3vV2FY32P0zG9j9FivJ2TYinbBcaqg8g
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:56 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-store, proxy-revalidate
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=bUzapjkX3vV2FY32P0zG9j9FivJ2TYinbBcaqg8g
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 9AE5
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=513820ab15a1fef8&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub8730968190912
https://t.adx.opera.com/sync?vendor=60369&pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU40eaf4869e9c48c89b4bb907a6a3a562

42 B
314 B

141ms
139ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU40eaf4869e9c48c89b4bb907a6a3a562
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:56 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:56 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU40eaf4869e9c48c89b4bb907a6a3a562
pragma: no-cache
server: Tengine

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 716D
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=5736adbd-2588-11f0-9b68-a7b7f9b9ce33

42 B
325 B

129ms
129ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=5736adbd-2588-11f0-9b68-a7b7f9b9ce33
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 29 Apr 2025 23:39:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Wed, 30 Apr 2025 05:59:55 GMT
Expires: Thu, 23 Sep 2004 17:42:04 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=5736adbd-2588-11f0-9b68-a7b7f9b9ce33
P3P: CP="NOI OTC OTP OUR NOR"
Pragma: no-cache
cache-control: max-age=0, private, must-revalidate
vary: accept-encoding

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame 51C0 0
181 B 409ms
136ms Document
text/html 165.227.251.217
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 165.227.251.217 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Wed, 30 Apr 2025 05:59:55 GMT

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 04AB
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:30216811-bc5b-4800-b3cb-1b0fce8da45a&gdpr=0&gdpr_consent=

42 B
210 B

132ms
131ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:30216811-bc5b-4800-b3cb-1b0fce8da45a&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Date: Wed, 30 Apr 2025 05:59:55 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Referrer-Policy: strict-origin
Server: MT3 1845 2ef6307 master ord ord-pixel-x20 config_version:"3339"
Strict-Transport-Security: 31536000
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
X-XSS-Protection: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:30216811-bc5b-4800-b3cb-1b0fce8da45a&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2178
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw

42 B
95 B

143ms
129ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 9384d0dcff3bd7a7-LAX
content-type: text/html
date: Wed, 30 Apr 2025 05:59:55 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-function: 209
x-reuse-index: 32

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2994
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=6isN08KKYIwKi4Y2HFHjQXMl4K9XV2oa_zrWSunsWK4&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1N...

42 B
349 B

127ms
127ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=6isN08KKYIwKi4Y2HFHjQXMl4K9XV2oa_zrWSunsWK4&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT Wed, 30 Apr 2025 05:59:56 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=6isN08KKYIwKi4Y2HFHjQXMl4K9XV2oa_zrWSunsWK4&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&tc=1
pragma: no-cache
vary: Accept-Encoding

GET pubmatic
ad.mrtnsvr.com/sync/ Frame E77D 0
0

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame E7A1
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=2CE43D09-E787-4EA4-BBBB-43A8A771D313
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=e0b7e9e5-b07f-48cd-a58f-057583cb64ea

42 B
308 B

119ms
117ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=e0b7e9e5-b07f-48cd-a58f-057583cb64ea
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=e0b7e9e5-b07f-48cd-a58f-057583cb64ea
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

mw
mwzeom.zeotap.com/ Frame E7A1
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-sD.Yzm9E2pSKqhy5BfDqS.aYDAPoPixyGA--~A&gdpr=0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=c10bf867c6452b26d11696a3dec13b07&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=5f3c15fa-5ad5-4cf0-a921-067639c86658&icm&gdpr=0&gdpr_consent=&cver
https://spl.zeotap.com/?zdid=1332&zcluid=01a8d8ca3229c091
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=df9ba25c-8272-4d63-61ab-a710d706cf79&reqId=01e34d6e-3c3c-4639-4bf6-c5452cd503aa&zclui...
https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=df9ba25c-8272-4d63-61ab-a710d706cf79&reqId=01e34d6e-3c3c-4639-4bf6-c5452cd503aa&zcluid=01a8d8ca322...

95 B
188 B

240ms
226ms

Image
image/png

2606:4700:10::6816:3262
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=df9ba25c-8272-4d63-61ab-a710d706cf79&reqId=01e34d6e-3c3c-4639-4bf6-c5452cd503aa&zcluid=01a8d8ca3229c091&zdid=1332&google_error=15

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700:10::6816:3262 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 9384d0ebdc721020-LAX
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Wed, 30 Apr 2025 05:59:58 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=df9ba25c-8272-4d63-61ab-a710d706cf79&reqId=01e34d6e-3c3c-4639-4bf6-c5452cd503aa&zcluid=01a8d8ca3229c091&zdid=1332&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
date: Wed, 30 Apr 2025 05:59:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame E7A1
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=2CE43D09-E787-4EA4-BBBB-43A8A771D313&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=2CE43D09-E787-4EA4-BBBB-43A8A771D313&sInitiator=external&gdpr=0&gdpr_consent=

42 B
626 B

302ms
302ms

Image
image/gif

95.173.218.112
CDN77 Datacamp Li...

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=2CE43D09-E787-4EA4-BBBB-43A8A771D313&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 95.173.218.112 Praha 10, Czech Republic, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-95-173-218-112.datapacket.com
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Routing-Server-ID: -1
Frontend-ID: 0
Pragma: no-cache
Connection: keep-alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
Content-Length: 42
UIP-Response-Status: Ok
Date: Wed, 30 Apr 2025 05:59:56 GMT
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Content-Type: image/gif

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=2CE43D09-E787-4EA4-BBBB-43A8A771D313&sInitiator=external&gdpr=0&gdpr_consent=
Routing-Server-ID: -1
Frontend-ID: 6
Pragma: no-cache
Connection: keep-alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
UIP-Response-Status: Ok
Date: Wed, 30 Apr 2025 05:59:56 GMT
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MkNFNDNEMDktRTc4Ny00RUE0LUJCQkItNDNBOEE3NzFEMzEz&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

267ms
137ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E7A1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=LOQ9CeeHTqS7u0Oop3HTEw%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

4 KB
4 KB

135ms
134ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=21779
content-encoding: gzip
expires: Wed, 30 Apr 2025 12:02:54 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Wed, 30 Apr 2025 05:59:55 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

404ms
135ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:328BA1190A594686B6B64D0FFEE32A0C

42 B
247 B

136ms
135ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:328BA1190A594686B6B64D0FFEE32A0C
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:328BA1190A594686B6B64D0FFEE32A0C
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 29 Apr 2025 05:59:55 GMT
access-control-allow-origin: *
content-length: 142
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=

42 B
314 B

394ms
130ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=
content-length: 355
date: Wed, 30 Apr 2025 05:59:55 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-NL8ZWEpE2uWQ5PBA9E.HUbnzsOFi1js-~A&gdpr=0

0
261 B

423ms
129ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-NL8ZWEpE2uWQ5PBA9E.HUbnzsOFi1js-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:56 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-NL8ZWEpE2uWQ5PBA9E.HUbnzsOFi1js-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/html
server: ATS

GET
H2 200 2CE43D09-E787-4EA4-BBBB-43A8A771D313
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame E7A1 43 B
517 B 142ms
136ms Image
image/gif 2600:1f18:4e9:5a01:ad49:aa38:c848:3cfd
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/2CE43D09-E787-4EA4-BBBB-43A8A771D313?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:ad49:aa38:c848:3cfd Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=56e2f9e2-4c3d-4d99-83cc-f01407670b97&gdpr=0&gdpr_consent=

1 B
336 B

202ms
133ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=56e2f9e2-4c3d-4d99-83cc-f01407670b97&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:54 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: e590e10d-2aec-4526-bedd-4e6a8af41ae6
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=56e2f9e2-4c3d-4d99-83cc-f01407670b97&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&gdpr=0&gdpr_consent=

42 B
538 B

406ms
136ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
server: A

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame E7A1 0
35 B 397ms
130ms Image
text/plain 18.204.134.9
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.134.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-134-9.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 30 Apr 2025 05:59:55 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=2c1a849c0dba14b3&is_secure=true&networkId=17100&version=1&nuid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGIudfeR541AIQ7bgLAQEBAQEBAQCXhEbGdAEBAQEBAQEB&expiration=1746079196&nuid=2CE43D09-E787-4E...

42 B
449 B

129ms
129ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGIudfeR541AIQ7bgLAQEBAQEBAQCXhEbGdAEBAQEBAQEB&expiration=1746079196&nuid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 29 Apr 2025 23:39:42 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGIudfeR541AIQ7bgLAQEBAQEBAQCXhEbGdAEBAQEBAQEB&expiration=1746079196&nuid=2CE43D09-E787-4EA4-BBBB-43A8A771D313&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
pragma: no-cache
server: nginx

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E7A1
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7107673749872378488&gdpr=0&gdpr_consent=&us_privacy=

1 B
244 B

268ms
137ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7107673749872378488&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7107673749872378488&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 05:59:54 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame E7A1
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R37AA2_12791A0EE_21129E12B&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

144ms
143ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.68.201.140 Ashburn, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-428997595; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-428997595; includeSubDomains
Cache-Control: no-cache
Date: Wed, 30 Apr 2025 05:59:55 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:55 GMT
server: nginx

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4A2B 20 KB
7 KB 134ms
134ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=21779
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Wed, 30 Apr 2025 05:59:55 GMT
expires: Wed, 30 Apr 2025 12:02:54 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 B33043583.413597246;dc_ver=105.313;dc_eid=40004001;sz=160x600;u_sd=1;gdpr=0;nel=1;dvs1=1;dvs10=1;dvs12=1;dvs13=160x600;dvs14=Casale;dvs15=186779;dvs16=2103387;dvs17=112;dvs18=paint.toys;dvs19=67325... Show response
ad.doubleclick.net/ddm/adj/N1861860.2542313ZETAGLOBAL/ Frame D569 95 KB
37 KB 322ms
179ms Script
text/javascript 142.250.80.6
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1861860.2542313ZETAGLOBAL/B33043583.413597246;dc_ver=105.313;dc_eid=40004001;sz=160x600;u_sd=1;gdpr=0;nel=1;dvs1=1;dvs10=1;dvs12=1;dvs13=160x600;dvs14=Casale;dvs15=186779;dvs16=2103387;dvs17=112;dvs18=paint.toys;dvs19=673259;dvs2=https%253A%252F%252Fpaint.toys%252Foil;dvs20=2079;dvs3=Mozilla%252F5.0%2B%2528X11%253B%2BLinux%2Bx86_64%2529%2BAppleWebKit%252F537.36%2B%2528KHTML%252C%2Blike%2BGecko%2529%2BChrome%252F135.0.0.0%2BSafari%252F537.36;dvs4=5840043;dvs5=51668;dvs6=212237;dvs7=c8d5147f2bc4d0cc021360097c1261e1;dvs8=51668;dvs9=162.245.206.0;dc_adk=2127703304;ord=c8fx4t;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01ODQwMDQzLDEyNDYxNjQ1MSwyNzk1Njc5LDU1MDcyMDg1NywyMTIyMzcsMjEwMzM4NyxjOGQ1MTQ3ZjJiYzRkMGNjMDIxMzYwMDk3YzEyNjFlMSxwLDUxNjY4LDY3MzI1OSwxNDQ5MjYwODksNjAzNzY3LDE1MTUyODkmbXQ9MSZyYj0yMDc5JnJlPTM3NTQ1JmhjaT0mdXVpZD04MTQ4NTc0MTMwMjUyODY4Mjk2JnVzdD05JnVzPVhZMjExNzdVRjk0LXhocEY1SDZjVWlGMVIzc3Q4NVNnWnFrLWZ2SHZVUVZmQ3E3WUUmZGk9JmRjPTMmZGlzcmM9MCZiaXA9MTYyLjI0NS4yMDYuMCZkaWQ9dGlkXzIxMDMzODd8bWVkX3JlZ3VsYXImYmNtaT0xMDA0Nzc.%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fpaint.toys%2F$0;xdt=1;crlt=SVh6hiXA(3;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=306;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v105.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.6 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f6.1e100.net

Software

cafe /

Resource Hash

3c9641ccb989ef18295636aa66856cdb5457b335d2fa170f24f946422e9df30e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37465
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3

200

setuid
prebid.intergient.com/ Frame 4971
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY&us_privacy=1NNY&khaos=MA3J10E5-2-7OJK
https://prebid.intergient.com/setuid?bidder=rubicon&uid=MA3J10E5-2-7OJK&us_privacy=1NNY

0
681 B

173ms
172ms

Image
text/html

104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=rubicon&uid=MA3J10E5-2-7OJK&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 9384d0dfcecc2f4a-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: text/html
vary: Origin
server: cloudflare
priority: u=3,i

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MA3J10E5-2-7OJK&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
content-length: 0
Content-Type: text/html

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame BCF6 0
925 B 134ms
133ms Script
text/html 68.67.160.186
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.248; 162.245.206.248; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 7b61049a-5d5e-4c2d-9669-f0f452f6a003
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
DATA 200
OK truncated
/ Frame E77D 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E77D 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame EFB7
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?us_privacy=pbs-ozone&gdpr=0&gdpr_consent=&s=189937&cb=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D0%26gdpr_consent%3D%26us_pr...
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-ozone%26uid%3D&gdpr=0&gdpr_consent=&s=1...
https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aBG8W9HM4YMACrq0AYs4LgAA%262449

0
298 B

142ms
141ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aBG8W9HM4YMACrq0AYs4LgAA%262449
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4&33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s/aFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5+tMRPp+Z7nGPqHDLO6f+RdlEg1+ecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM/nNtc3jHvvWgZV33tjXGpiN9joWm7S/ZfefrSF+3JHzWqgcOAqb966OqkwG/FGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D+VeedIoDUXyoGNzUun9J/e8n+NySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6+85yML388gCqz4+SRXESEkbgkjZseeeoBa4u65epTSTOaVmCm+5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY+9i/62iNk9W067UjCrEWkFqkzc/5xHfjPFRTo3l6DKglfhseX+VIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4+gG79x/SCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751/CkAXjGMCUv3MjqR8/0ckLAEt4jIeqiMIut73tkolu18j6+wbs7W2nWSYEQ6fYtxJuh8eI/HrDY+aHT6zU8tXVh0//W5sDZfUyPN/U+kb+cLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc/jzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB+KLoqRnp24U2Vc+UrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh/bz+kIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW/qyO2PnKOs2dGCXCz9TsE4uXrC3L+J1W4qAz12hBEIT2lTYbfhvN/64zUpIgjM4LF9C/mM+A8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn/h5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0+/Dap0Ch1dyXJSzQd/Voa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745992792011&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 9384d0dfed632f10-LAX
expires: 0
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: https://elb.the-ozone-project.com/setuid?bidder=ix&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=aBG8W9HM4YMACrq0AYs4LgAA%262449
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JkPpsFyto8JLzNkNUogzD%2FiRFvCDwGwOo0FRq5%2F1%2FLoTseUrELvPE%2BIQ95YcAGMJuzzc0Lo1n1eFIw5eQlNka%2BNwuWodc1Hh74sK3DmNHF5rGTHuwaDXrCozQ6Q02jGOIVMTu9yf"}],"group":"cf-nel","max_age":604800}
cf-ray: 9384d0df5ef4c213-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 05:59:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 6D72 1 KB
2 KB 145ms
142ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: d2e07d479a5379b65b606e13dea0a81d6278e2b7a2b234f68628b91a3b56c1c7

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1174
content-type: text/html; charset=utf-8
date: Wed, 30 Apr 2025 05:59:55 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 4971
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/7bq3g_0ghxA5wO4PrG_S1g?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ELwIIjlE2oJPU3GXHcYAKapbUywI7csfvDe.JA--~A

42 B
1 KB

338ms
126ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ELwIIjlE2oJPU3GXHcYAKapbUywI7csfvDe.JA--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2fcb300b847bad3e7dd1184ec8a1c2f5
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ELwIIjlE2oJPU3GXHcYAKapbUywI7csfvDe.JA--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT
server: ATS
x-frame-options: DENY

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4971
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUEzSjEwRTUtMi03T0pL&us_privacy=1NNY

170 B
188 B

153ms
153ms

Image
image/png

142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUEzSjEwRTUtMi03T0pL&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUEzSjEwRTUtMi03T0pL&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: eea754ae2ea80a3b4eb2fcf35349058a
Pragma: no-cache
content-length: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 4971
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MA3J10E5-2-7OJK&us_privacy=1NNY

0
146 B

108ms
107ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MA3J10E5-2-7OJK&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 40A47BC433D9416FBF0EB353D6FA3F38 Ref B: LAX311000110023 Ref C: 2025-04-30T05:59:56Z
x-li-fabric: prod-lor1
x-li-uuid: AAYz+KBlCzMT2/5y+tn/CA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 30 Apr 2025 05:59:55 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MA3J10E5-2-7OJK&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Pragma: no-cache
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4971
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MGE5ZDRhNTk1M2U2YTBlYmRhZTA4NDliYzU1ZDk1YWUwODc0NzRhNw&us_privacy=1NNY

170 B
188 B

152ms
151ms

Image
image/png

142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MGE5ZDRhNTk1M2U2YTBlYmRhZTA4NDliYzU1ZDk1YWUwODc0NzRhNw&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MGE5ZDRhNTk1M2U2YTBlYmRhZTA4NDliYzU1ZDk1YWUwODc0NzRhNw&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 4971
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

410ms
126ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5f3c15fa-5ad5-4cf0-a921-067639c86658&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Wed, 30 Apr 2025 05:59:55 GMT
server: Kestrel

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 4971 170 B
188 B 156ms
155ms Image
image/png 142.250.80.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 30 Apr 2025 05:59:55 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 4971
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=MA3J10E5-2-7OJK&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

141ms
140ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MA3J10E5-2-7OJK&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 6GRRCDKR0TDXVTHFDXJB
Content-Length: 43
Date: Wed, 30 Apr 2025 05:59:56 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MA3J10E5-2-7OJK&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 4971
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY&dcc=t

43 B
855 B

273ms
156ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: Q6ZWHSEPAJPYRBYET3D7
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 30 Apr 2025 05:59:56 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 9E5QRM8R7A3Z24JPZT7Z
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 30 Apr 2025 05:59:55 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame 4971
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY&dcc=t

43 B
855 B

295ms
294ms

Image
image/gif

67.220.226.238
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

67.220.226.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: TXJBNX2HE87498NPT6NC
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 30 Apr 2025 05:59:56 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: M0WPXEFT6MEMMRH275MR
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 30 Apr 2025 05:59:56 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 4971
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAC8sE7QI3kAAFKpTt2QEg&expires=30

42 B
1 KB

143ms
126ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAC8sE7QI3kAAFKpTt2QEg&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAC8sE7QI3kAAFKpTt2QEg&expires=30
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:56 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

pixel
capi.connatix.com/us/ Frame 4971
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1NNY
https://capi.connatix.com/us/pixel?puid=MA3J10E5-2-7OJK&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY

0
329 B

200ms
102ms

Image
text/plain

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=MA3J10E5-2-7OJK&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 9384d0e13f41cb86-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=MA3J10E5-2-7OJK&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
content-length: 0
Content-Type: text/html

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 4971
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&us_privacy=1NNY
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MA3J10E5-2-7OJK&us_privacy=1NNY

68 B
324 B

405ms
132ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MA3J10E5-2-7OJK&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-202-124-0.compute-1.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MA3J10E5-2-7OJK&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
content-length: 0
Content-Type: text/html

GET
H2

200

receive
pixel.tapad.com/idsync/ex/ Frame 4971
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1&us_privacy=1NNY
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MA3J10E5-2-7OJK&us_privacy=1NNY

95 B
424 B

98ms
98ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MA3J10E5-2-7OJK&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MA3J10E5-2-7OJK&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 4971
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=56e2f9e2-4c3d-4d99-83cc-f01407670b97&expires=30&us_privacy=1NNY

42 B
1 KB

133ms
125ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=56e2f9e2-4c3d-4d99-83cc-f01407670b97&expires=30&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 8bab65602db075726861004da5629947
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: 6aebb1de-46f2-40ed-9c85-cf06b62c15af
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=56e2f9e2-4c3d-4d99-83cc-f01407670b97&expires=30&us_privacy=1NNY
Content-Length: 164
Date: Wed, 30 Apr 2025 05:59:56 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

ProfilesEngineServlet
syncv4.intentiq.com/profiles_engine/ Frame 4971
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&us_privacy=1NNY
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=MA3J10E5-2-7OJK&us_privacy=1NNY
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MA3J10E5-2-7OJK
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MA3J10E5-2-7OJK&ckls=true&ci=UsHhvFJgMW&nc=false&trid=965865285

43 B
1 KB

431ms
150ms

Image
image/gif

3.168.122.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MA3J10E5-2-7OJK&ckls=true&ci=UsHhvFJgMW&nc=false&trid=965865285
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.168.122.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-122-29.jfk52.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 6a75aefffb503ce28b1881b80e9ba240.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: XHE_6QoEDzaroJtN-8hZDzthLl9TAEvtmfBoj7AWntdYAoGl08ktPQ==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MA3J10E5-2-7OJK&ckls=true&ci=UsHhvFJgMW&nc=false&trid=965865285
pragma: no-cache
via: 1.1 92f94ac195c7f28197d4898bcd6519b8.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: oXVzm28fZd63efgJQx2AkU_GD5gdZCAKBl5AnkHGOKZJM3TlyidMtg==

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 4971
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&us_privacy=1NNY
https://prebid.a-mo.net/setuid/magnite?uid=MA3J10E5-2-7OJK&us_privacy=1NNY

0
730 B

433ms
133ms

Image
text/plain

125.253.89.183
SS-ASH

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=MA3J10E5-2-7OJK&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 125.253.89.183 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Wed, 30 Apr 2025 05:59:55 GMT
x-envoy-upstream-service-time: 4
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.a-mo.net/setuid/magnite?uid=MA3J10E5-2-7OJK&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
content-length: 0
Content-Type: text/html

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 149ms
148ms Fetch
text/plain 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je54s1v9101576445za200&_p=1745992789780&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116026~103173737~103173739~103200004&cid=132795969.1745992791&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAI&_s=2&sid=1745992790&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fwxqdz.zerrasoft.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=10&tfd=6780
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/plain
server: Golfe2

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D72
Redirect Chain

https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=&_bee_ppp=1
https://eb2.3lift.com/xuid?mid=7255&xuid=AABMLE7QI3kAAFNGzYeRVg&dongle=bzwx&gdpr=0

37 B
476 B

143ms
143ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7255&xuid=AABMLE7QI3kAAFNGzYeRVg&dongle=bzwx&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://eb2.3lift.com/xuid?mid=7255&xuid=AABMLE7QI3kAAFNGzYeRVg&dongle=bzwx&gdpr=0
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:56 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 6D72 43 B
168 B 134ms
132ms Image
image/gif 3.82.184.152
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=20&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.82.184.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-82-184-152.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 6D72 43 B
168 B 144ms
132ms Image
image/gif 3.82.184.152
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=114&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.82.184.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-82-184-152.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D72
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://eb2.3lift.com/xuid?mid=3702&xuid=${ADELPHIC_CUID}&dongle=d54f&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3702&xuid=56e2f9e2-4c3d-4d99-83cc-f01407670b97&dongle=d54f&gdpr=0&gdpr_consent=

37 B
476 B

148ms
147ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3702&xuid=56e2f9e2-4c3d-4d99-83cc-f01407670b97&dongle=d54f&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

Redirect headers

X-CI-RTID: 7e6543c1-bdcf-4052-adf3-21b6f42284da
Location: https://eb2.3lift.com/xuid?mid=3702&xuid=56e2f9e2-4c3d-4d99-83cc-f01407670b97&dongle=d54f&gdpr=0&gdpr_consent=
Content-Length: 149
Date: Wed, 30 Apr 2025 05:59:55 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D72
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=83&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&partner_url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3646%26xuid%3Dc2ed...
https://eb2.3lift.com/xuid?mid=3646&xuid=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&dongle=1fa5&gdpr=0&gdpr_consent=

37 B
476 B

143ms
143ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3646&xuid=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&dongle=1fa5&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=3646&xuid=c2ed677f-0d2d-4cb4-8be2-24027e7918d0-6811bc5b-5553&dongle=1fa5&gdpr=0&gdpr_consent=
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
server: Jetty(11.0.25)

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D72
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=2902015482444764482798&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=5543a60e-e1c5-4845-9c71-a343412086e7&ssp=triplelift&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10611536255465883448&ssp=triplelift&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10611536255465883448&ssp=triplelift&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=triplelift
https://x.bidswitch.net/sync?dsp_id=419&user_id=10611536255465883448&ssp=triplelift&gdpr=&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2409&xuid=5543a60e-e1c5-4845-9c71-a343412086e7&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
476 B

143ms
143ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=5543a60e-e1c5-4845-9c71-a343412086e7&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //eb2.3lift.com/xuid?mid=2409&xuid=5543a60e-e1c5-4845-9c71-a343412086e7&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:57 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D72
Redirect Chain

https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=4771&xuid=7107673749872378488&dongle=d407&gdpr=0&gdpr_consent=

37 B
476 B

145ms
144ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=4771&xuid=7107673749872378488&dongle=d407&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://eb2.3lift.com/xuid?mid=4771&xuid=7107673749872378488&dongle=d407&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 30 Apr 2025 05:59:55 GMT

GET 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame 6D72 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D72
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://b1sync.outbrain.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&s=2
https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&obuid=a071208d-bc3a-45a3-b32e-2815aa53fa72&s=2
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=a071208d-bc3a-45a3-b32e-2815aa53fa72&gdpr=0

37 B
476 B

149ms
143ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=a071208d-bc3a-45a3-b32e-2815aa53fa72&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=a071208d-bc3a-45a3-b32e-2815aa53fa72&gdpr=0
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 131
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D72
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=328BA1190A594686B6B64D0FFEE32A0C&dongle=yf3

37 B
476 B

148ms
147ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=328BA1190A594686B6B64D0FFEE32A0C&dongle=yf3
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://eb2.3lift.com/xuid?mid=7969&xuid=328BA1190A594686B6B64D0FFEE32A0C&dongle=yf3
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 29 Apr 2025 05:59:55 GMT
access-control-allow-origin: *
content-length: 142
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 200 setuid
prebid.intergient.com/ Frame 6D72 0
600 B 186ms
179ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=2902015482444764482798

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 9384d0de9d192f4a-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: text/html
vary: Origin
server: cloudflare
priority: u=3,i

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame D569 474 KB
115 KB 476ms
147ms Script
text/javascript 2600:141b:1c00:44::17db:244d
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: wxqdz.zerrasoft.com
URL: https://wxqdz.zerrasoft.com/qcrfkn1t750epptlhx3yfhtoRVlJnRkNQZ3ByMTV2bG5sYWJxcUYtMjc2Mi0yNTg3NTg4NC0xMDI1MDI4MS00MDMxLXNLQVFGYTNaTlc0UXNHbEFrenE5/wdp1uabo8w2/IkndmU6hRUtS8J/872508889152709574060010039688740
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:44::17db:244d Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: b6966483933e97a11e616a2434b912ba805ceb6dcef79c5acbfd89011450848e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: gzip
ETag: "9d3d53bbcc2cffd2fd9fcc9f07d4b19c"
Connection: keep-alive
Expires: Wed, 30 Apr 2025 06:14:56 GMT
Access-Control-Allow-Origin: *
Content-Length: 117479
Date: Wed, 30 Apr 2025 05:59:56 GMT
Last-Modified: Mon, 28 Apr 2025 14:01:45 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame D569 117 KB
41 KB 427ms
136ms Script
text/javascript 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 70895
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 10:18:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Apr 2025 10:18:21 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250429/r20110914/elements/html/ Frame D569 12 KB
4 KB 137ms
136ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250429/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1861860.2542313ZETAGLOBAL/B33043583.413597246;dc_ver=105.313;dc_eid=40004001;sz=160x600;u_sd=1;gdpr=0;nel=1;dvs1=1;dvs10=1;dvs12=1;dvs13=160x600;dvs14=Casale;dvs15=186779;dvs16=2103387;dvs17=112;dvs18=paint.toys;dvs19=673259;dvs2=https%253A%252F%252Fpaint.toys%252Foil;dvs20=2079;dvs3=Mozilla%252F5.0%2B%2528X11%253B%2BLinux%2Bx86_64%2529%2BAppleWebKit%252F537.36%2B%2528KHTML%252C%2Blike%2BGecko%2529%2BChrome%252F135.0.0.0%2BSafari%252F537.36;dvs4=5840043;dvs5=51668;dvs6=212237;dvs7=c8d5147f2bc4d0cc021360097c1261e1;dvs8=51668;dvs9=162.245.206.0;dc_adk=2127703304;ord=c8fx4t;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01ODQwMDQzLDEyNDYxNjQ1MSwyNzk1Njc5LDU1MDcyMDg1NywyMTIyMzcsMjEwMzM4NyxjOGQ1MTQ3ZjJiYzRkMGNjMDIxMzYwMDk3YzEyNjFlMSxwLDUxNjY4LDY3MzI1OSwxNDQ5MjYwODksNjAzNzY3LDE1MTUyODkmbXQ9MSZyYj0yMDc5JnJlPTM3NTQ1JmhjaT0mdXVpZD04MTQ4NTc0MTMwMjUyODY4Mjk2JnVzdD05JnVzPVhZMjExNzdVRjk0LXhocEY1SDZjVWlGMVIzc3Q4NVNnWnFrLWZ2SHZVUVZmQ3E3WUUmZGk9JmRjPTMmZGlzcmM9MCZiaXA9MTYyLjI0NS4yMDYuMCZkaWQ9dGlkXzIxMDMzODd8bWVkX3JlZ3VsYXImYmNtaT0xMDA0Nzc.%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fpaint.toys%2F$0;xdt=1;crlt=SVh6hiXA(3;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=306;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

64142ab15fe359eee6c9c6fbc0494b14bebb33c91766d97c3da40a13eccc18b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 11478221875201388932
age: 39969
x-content-type-options: nosniff
expires: Tue, 13 May 2025 18:53:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 29 Apr 2025 18:53:47 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 4401
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D569 41 KB
14 KB 137ms
136ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 135
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Wed, 30 Apr 2025 06:47:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:57:41 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ Frame D569 16 KB
6 KB 431ms
138ms Script
text/javascript 108.139.47.92
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js?c1=8&c2=6820648&c3=1&c4=&c5=&c6=
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-92.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3f6004a6c9021e04ec32ca88df8f9a5785e53da23511f1bf0d56defc1b9759f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

vary: accept-encoding
cache-control: max-age=86400
content-encoding: gzip
etag: W/"c22322b3d030360971584a98c60b6e0b"
age: 82652
via: 1.1 4d3480855260c7e16c3a1df3eafacee6.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 6jQ776dixdB2BVCXS6ZQStrXBFyZN9xxNReYzcNVqGZd8v5Ledx3dw==
date: Tue, 29 Apr 2025 07:02:25 GMT
content-type: text/javascript
last-modified: Mon, 16 Dec 2024 11:22:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P1
x-amz-server-side-encryption: AES256

GET
H2

200

sync
pippio.com/api/ Frame D569
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=8148574130252868296&referrer=https%3A%2F%2Fpaint.toys%2F&forward=
https://p.rfihub.com/cm?pub=39342&in=0&userid=7333d071-86aa-47be-8f94-20e73c3852e0%3A1745992796.44659&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D7333d071-86aa-47be-8...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=8148574130252868296&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D7333d0...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=7333d071-86aa-47be-8f94-20e73c3852e0%3A1745992796.44659&pid=500040&it=1&iv=7333d071-86aa-47be-8f94-20e73c3852e0%3A1745992796.44659&_=1745992...
https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.447499&iv=7333d071-86aa-47be-8f94-20e73c3852e0:1745992796.44659

42 B
345 B

265ms
122ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.447499&iv=7333d071-86aa-47be-8f94-20e73c3852e0:1745992796.44659
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.447499&iv=7333d071-86aa-47be-8f94-20e73c3852e0:1745992796.44659
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:56 GMT
trace-id: 3851739f37646415
Request-Time: 1
Connection: keep-alive

GET
H2

200

sync
pippio.com/api/ Frame D569
Redirect Chain

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=ODE0ODU3NDEzMDI1Mjg2ODI5Ng==&forward=
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_error=15
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=8148574130252868296&referrer={encSite}&forward=
https://p.rfihub.com/cm?pub=39342&in=0&userid=6870b65b-bf9c-4cac-bd41-7542f522e3e8%3A1745992796.467777&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D6870b65b-bf9c-4cac-...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=8148574130252868296&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D6870b6...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=6870b65b-bf9c-4cac-bd41-7542f522e3e8%3A1745992796.467777&pid=500040&it=1&iv=6870b65b-bf9c-4cac-bd41-7542f522e3e8%3A1745992796.467777&_=17459...
https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.4689026&iv=6870b65b-bf9c-4cac-bd41-7542f522e3e8:1745992796.467777

42 B
183 B

126ms
125ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.4689026&iv=6870b65b-bf9c-4cac-bd41-7542f522e3e8:1745992796.467777
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.4689026&iv=6870b65b-bf9c-4cac-bd41-7542f522e3e8:1745992796.467777
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:57 GMT
trace-id: 185b9c244002ab0c
Request-Time: 1
Connection: keep-alive

GET
H2 200 setuid
ib.adnxs.com/ Frame D569 43 B
1 KB 152ms
125ms Image
image/gif 68.67.160.186
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=18&code=8148574130252868296

Requested by

Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.248; 162.245.206.248; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 2913b573-d285-436d-bcd0-3d26c87db74e
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 30 Apr 2025 05:59:56 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

GET
H2 200 ibs:dpid=1121&dpuuid=8148574130252868296&redir=
dpm.demdex.net/ Frame D569 42 B
715 B 414ms
133ms Image
image/gif 54.88.228.209
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=8148574130252868296&redir=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.88.228.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-88-228-209.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v076-0309946a6.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: ulN1lTgCT58=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ Frame D569 42 B
195 B 154ms
128ms Image
image/gif 207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw==&piggybackCookie=8148574130252868296&r=
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif; charset=utf-8
server: nginx

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame D569 43 B
61 B 108ms
95ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073062&val=8148574130252868296&r=
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 30 Apr 2025 05:59:55 GMT
content-type: image/gif
vary: Accept

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame D569
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=8148574130252868296&bid=omt9pi0

70 B
440 B

528ms
132ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=8148574130252868296&bid=omt9pi0
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 30 Apr 2025 05:59:56 GMT
Content-Type: image/gif

Redirect headers

Location: https://ps.eyeota.net/match?uid=8148574130252868296&bid=omt9pi0
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Date: Wed, 30 Apr 2025 05:59:56 GMT
Server: Jetty(9.4.51.v20230217)

GET
H2 200 cksync.php
contextual.media.net/ Frame D569 103 B
568 B 470ms
173ms Image
image/gif 23.41.168.23
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=8148574130252868296

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-41-168-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ab463a9907ed230b168209510175be2f0842209d4839c44367217d7c43a69336

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
pragma: no-cache
expires: Wed, 30 Apr 2025 05:59:56 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length: 103
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif
server: Apache

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame D569 43 B
109 B 446ms
159ms Image
image/gif 34.192.76.2
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=11017&user_id=8148574130252868296
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.192.76.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-76-2.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-length: 43
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif
server: awselb/2.0

GET
H2

200

sync
nlsn.thrtle.com/ Frame D569
Redirect Chain

https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=8148574130252868296
https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D
https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=7107673749872378488
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=06a5ced7-219c-444b-8b8f-69fc7893d5ab&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=06a5ced7-219c-444b-8b8f-69fc7893d5ab&vxii_pid=12&vxii_pid1=7006&vxii_rcid=f93bd5f5-0fb1-4db2-9b5d-ea879550a62f&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=f93bd5f5-0fb1-4db2-9b5d-ea879550a62f
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=5f3c15fa-5ad5-4cf0-a921-067639c86658
https://thrtl.redinuid.imrworldwide.com/thrtl?url=https%3A%2F%2Fnlsn.thrtle.com%2Fsync%3Fvxii_pid%3D5036%26vxii_ts%3D2
https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=57d93cc0-2588-11f0-aa24-2782860761ce

43 B
540 B

142ms
133ms

Image
image/gif

52.54.192.84
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=57d93cc0-2588-11f0-aa24-2782860761ce
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 52.54.192.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-192-84.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
access-control-allow-origin: *
location: https://nlsn.thrtle.com/sync?vxii_pid=5036&vxii_ts=2&puid=57d93cc0-2588-11f0-aa24-2782860761ce
content-length: 0
date: Wed, 30 Apr 2025 05:59:57 GMT
cross-origin-resource-policy: cross-origin

GET
H2 200 rum
dsum-sec.casalemedia.com/ Frame D569 43 B
341 B 119ms
94ms Image
image/gif 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=8148574130252868296&forward=
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u3n0OvRLL8pwxNfxz9knmGrlt%2FkwtXDh6VCYFm2OEs%2F7W2JgtwkZrnP5vwGNYRCZpLQXyKcS9XO%2BL5pzChISWHUO5CyU28RG1cIr3mrZaEE2zLCD%2BYutyH7vOJ2HfpMlPQ1LCjisfYB%2FOA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9384d0dfb80dc213-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

GET
H3 200 360947.gif
idsync.rlcdn.com/ Frame D569 42 B
60 B 134ms
124ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=8148574130252868296
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

GET
H2 200 sync
partners.tremorhub.com/ Frame D569 43 B
175 B 419ms
130ms Image
image/gif 2600:1f10:4ce4:4a00:f584:4417:4061:dc4a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=8148574130252868296&r=sGuy3RBhZL14
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f10:4ce4:4a00:f584:4417:4061:dc4a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif
server: nginx

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame D569 43 B
527 B 444ms
139ms Image
image/gif 108.138.128.21
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=8148574130252868296
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-21.jfk50.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 0afec277ba3e75e96fa6b4c76d8e130c.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif
x-amz-cf-pop: JFK50-P4
server: AAWebServer
x-amz-cf-id: swPmiNWyM8Dnv5tXevnkGNMfpudv8P2AasVqVg_ZCkMni2ac99xlag==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 sync
x.bidswitch.net/ Frame D569 43 B
103 B 158ms
140ms Image
image/gif 35.211.202.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=119&user_id=8148574130252868296&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}
Requested by: Host: a.rfihub.com
URL: https://a.rfihub.com/bn/ar.js?bt=1745992794271&aeh=1&w=160&h=600&co=optimize%3Afalse%2CserverId%3Aewr-529%2CnewUser%3Afalse%2CscoreMicroClicks%3A0%2CscoreMicroConversions%3A202%2CuV%3A859657%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Aewr-529.ewr-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1745992794271%2Csej%3Afalse%2Cmt%3A1%2Cdid%3Atid_2103387%7Cmed_regular%2Cbcmi%3A100477%2CisAI%3Atrue%2CisSkip%3Afalse%2CexId%3A54ee39a9-0e80-42ae-93f0-d23d03939afa%2Cuuid%3A8148574130252868296%2CdiSrc%3A0%2CuR%3A15000%2Cip%3A162.245.206.0%2Cfcc%3A3%2Ctagid%3A2747221344%2Csid%3A186779%2Cp39%3A8%2Cge%3A%2Cust%3A9%2Cus%3AXY21177UF94-xhpF5H6cUiF1R3st85SgZqk-fvHvUQVfCq7YE&ri=c8d5147f2bc4d0cc021360097c1261e1&ai=5840043&rt=2103387&re=37545&rb=2079&ra=&hl=1716&sc=0&bs=1&dc=3&di=&ug=249611&ct=1745992794800&rs=&pe=https%3A%2F%2F804651cb231b488657bff183e519225d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-41%2Fhtml%2Fcontainer.html&pf=https%3A%2F%2Fpaint.toys%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif

GET
H2

200

/
sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/ Frame D569
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aBG8XAAAAjd5cAAL

85 B
149 B

218ms
218ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aBG8XAAAAjd5cAAL
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1745992796.493080,VS0,VE0
age: 1466
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/png
x-served-by: cache-mad22057-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 6744

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aBG8XAAAAjd5cAAL
x-timer: S1745992796.186046,VS0,VE87
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
x-served-by: cache-mad22057-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

m
secure-us.imrworldwide.com/cgi-bin/ Frame D569
Redirect Chain

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=8148574130252868296&cc=1
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=8148574130252868296&cc=1&ja=1

44 B
424 B

124ms
123ms

Image
image/gif

3.129.3.164
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=8148574130252868296&cc=1&ja=1
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 3.129.3.164 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-3-164.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
cross-origin-resource-policy: cross-origin
access-control-allow-methods: POST, OPTIONS
expires: Thu, 01 Dec 1994 16:00:00 GMT
access-control-allow-origin: *
content-length: 44
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
date: Wed, 30 Apr 2025 05:59:56 GMT
content-type: image/gif
server: nginx

Redirect headers

cache-control: no-cache
location: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=8148574130252868296&cc=1&ja=1
pragma: no-cache
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
cross-origin-resource-policy: cross-origin
access-control-allow-methods: POST, OPTIONS
expires: Thu, 01 Dec 1994 16:00:00 GMT
access-control-allow-origin: *
content-length: 0
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
date: Wed, 30 Apr 2025 05:59:56 GMT
server: nginx

GET
H2

200

sync
pippio.com/api/ Frame D569
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=8148574130252868296&referrer=https%3A%2F%2Fpaint.toys%2F
https://p.rfihub.com/cm?pub=39342&in=0&userid=7abacdee-3738-4a27-ac63-99066530d7b6%3A1745992796.566021&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D7abacdee-3738-4a27-...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=8148574130252868296&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D7abacd...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=7abacdee-3738-4a27-ac63-99066530d7b6%3A1745992796.566021&pid=500040&it=1&iv=7abacdee-3738-4a27-ac63-99066530d7b6%3A1745992796.566021&_=17459...
https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.5670435&iv=7abacdee-3738-4a27-ac63-99066530d7b6:1745992796.566021

42 B
183 B

122ms
122ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.5670435&iv=7abacdee-3738-4a27-ac63-99066530d7b6:1745992796.566021
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.5670435&iv=7abacdee-3738-4a27-ac63-99066530d7b6:1745992796.566021
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:57 GMT
trace-id: 1113ef5efa21473b
Request-Time: 1
Connection: keep-alive

GET
H3

200

sync
pippio.com/api/ Frame D569
Redirect Chain

https://i.liadm.com/s/90206?bidder_id=246508&bidder_uuid=8148574130252868296
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=06a5ced7-219c-444b-8b8f-69fc7893d5ab
https://p.rfihub.com/cm?pub=39342&in=1&userid=7abacdee-3738-4a27-ac63-99066530d7b6%3A1745992796.566021&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D7abacdee-3738-4a27-...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=8148574130252868296&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D7abacd...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=7abacdee-3738-4a27-ac63-99066530d7b6%3A1745992796.566021&pid=500040&it=1&iv=7abacdee-3738-4a27-ac63-99066530d7b6%3A1745992796.566021&_=17459...
https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.7917507&iv=7abacdee-3738-4a27-ac63-99066530d7b6:1745992796.566021

42 B
59 B

121ms
120ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.7917507&iv=7abacdee-3738-4a27-ac63-99066530d7b6:1745992796.566021
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H3
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 30 Apr 2025 05:59:57 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1745992796.7917507&iv=7abacdee-3738-4a27-ac63-99066530d7b6:1745992796.566021
Content-Length: 0
Date: Wed, 30 Apr 2025 05:59:57 GMT
trace-id: ed4f294e5ea881d9
Request-Time: 0
Connection: keep-alive

GET
H2 200 ca Show response
choices.trustarc.com/ Frame D569 35 KB
12 KB 487ms
147ms Script
text/javascript 108.139.47.39
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://choices.trustarc.com/ca?pid=zeta01&aid=zetaglobal01&cid=101619&c=ac3207a4-cef2-430f-a6f9-0cf396abbbca&w=160&h=600&plc=tr

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.47.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-139-47-39.jfk50.r.cloudfront.net

Software

nginx /

Resource Hash

168cd6080f8e9e886e3cde7507d4550e8133f5055949ea2a166f85abcf21af26

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 102294
expect-ct: max-age=31536000
x-content-type-options: nosniff
expires: Tue, 29 Apr 2025 02:35:02 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: c_zPRtbsunabZXnd06Irq3lNDEazyJMCDmGvG9Vw7CEmVKlW3RgC6A==
date: Tue, 29 Apr 2025 01:35:02 GMT
content-type: text/javascript;charset=utf-8
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
cache-control: max-age=3600
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
referrer-policy: origin
via: 1.1 5b4b6c6517b988a4ff2c794e5583ee02.cloudfront.net (CloudFront)
permissions-policy: geolocation=(), microphone=(), payment=()
cross-origin-embedder-policy: unsafe-none
x-xss-protection: 1; mode=block
x-amz-cf-pop: JFK50-P1
server: nginx

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 2BA3 38 KB
13 KB 136ms
135ms Document
text/html 142.250.80.1
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.1 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2715
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Apr 2025 05:14:41 GMT
expires: Wed, 30 Apr 2025 06:04:41 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame EFB7
Redirect Chain

https://x.bidswitch.net/sync?ssp=ozone&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=5543a60e-e1c5-4845-9c71-a343412086e7&ssp=ozone&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10611536255465883448&ssp=ozone&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10611536255465883448&ssp=ozone&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=ozone
https://x.bidswitch.net/sync?dsp_id=419&user_id=10611536255465883448&ssp=ozone&gdpr=&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=bidswitch&gdpr=&gdpr_consent=&us_privacy=&uid=5543a60e-e1c5-4845-9c71-a343412086e7

0
407 B

142ms
141ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=bidswitch&gdpr=&gdpr_consent=&us_privacy=&uid=5543a60e-e1c5-4845-9c71-a343412086e7
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=85705373-e58a-4bf0-8195-9d4477b84ce4&33across.com=v1.0014000001YrMoYAAV.1041.d6nkETZXIDrtPoCRK5NFWXN1ryb4s/aFD61cFqW44OmdG97zCneL19G4KxoHkJ9mD8WxhRKYKQ1514RqIxyq2wd2xlPG7FdklL5+tMRPp+Z7nGPqHDLO6f+RdlEg1+ecWhJGq5txY6O41DFPmzoBNDadRqVUvVyHlUdwzNMBo6Z3jFSz25ibkS6laDaxM/nNtc3jHvvWgZV33tjXGpiN9joWm7S/ZfefrSF+3JHzWqgcOAqb966OqkwG/FGVDRDJDlh8AGuOXVhJNwqtyTcZviK1JMGpWid8D+VeedIoDUXyoGNzUun9J/e8n+NySYsyAmUR7BTvNjjpBaL0Ej76Aydmb51NoBITqwJ6mOUPfXLhitHII9evpKBY6T03IerLAXX0UlALIgvMjvSqKM8cFr24hBQzvyFYdk4c1ehGSBmhz5N53WMFF6nJB3U9TFvaglhTsfsmfl4BGyqwpIUlZKKhh75ibjZAag5MHPwOEOazvHlYpcCtMn7ielUA5GvdLj4TfSscTUfJlhmNr25ZmFv5KYfuDQ8qfXRUtsc6+85yML388gCqz4+SRXESEkbgkjZseeeoBa4u65epTSTOaVmCm+5qBAIVOirpiIhh3dP2D23Or2I5DOxOmvmr3x6xDeHLyKY+9i/62iNk9W067UjCrEWkFqkzc/5xHfjPFRTo3l6DKglfhseX+VIgBvDJm8l7Dy2C9Jmlaq5nvS9czwjtZxysteFu96T4+gG79x/SCHJu2ANgT8XfikwcZk4P6OZsJ44TzlDlL72inzkxWIyQESwUymax3jbpMOuC29I2p5vRjYxdYFQu17C8ldQi0EbBI7iVYEvHTqi8mMZ9915eoSFiFaiyHxoEUAyaanZflPZJZOnwCKup751/CkAXjGMCUv3MjqR8/0ckLAEt4jIeqiMIut73tkolu18j6+wbs7W2nWSYEQ6fYtxJuh8eI/HrDY+aHT6zU8tXVh0//W5sDZfUyPN/U+kb+cLVYM4a3xVHB5gPLwNe6glAXg9ouVEfCSlwjPRYFxUHfuO6mVB3ruBuzbNAGxmjMoYwfq3TFmFLHI7OOCLzyovlfVKBUNtPf8FbMff22dPD9iOSxXU1N4Tj0STSmjc/jzxw0A0eJvB9BjlrrrawIQL9yKCzANtyqLJZUKZERaHpPq7sCM7HB+KLoqRnp24U2Vc+UrkLPilamBQEx5qcJLEjgF7VtnOqLjVvBz9ie4wTZORIh/bz+kIbKV92PzAo2Rs4gjrj3OZTVt9F38wgpI83GAZIimFO1FnlMyiHYxjJm7VoO9uCF69p8hc42KufaQlVq1xlvasVejMW/qyO2PnKOs2dGCXCz9TsE4uXrC3L+J1W4qAz12hBEIT2lTYbfhvN/64zUpIgjM4LF9C/mM+A8sxeFgr4HofCyAIgIItOhvqy0RTMQxipn/h5cwiMCnJqkl1QoS2BUOcAit4kqgkVDXccDfjGj0+/Dap0Ch1dyXJSzQd/Voa12wadLwcSugeZFmwztbtFvxAxZJBrYVXX0mEB&linkedin.com=c304743e-ff2d-4b1d-8a56-51f072282495&publisherId=OZONEPLA0001&siteId=3500001145&cb=1745992792011&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 9384d0e96d572f10-LAX
expires: 0
content-length: 0
date: Wed, 30 Apr 2025 05:59:57 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //elb.the-ozone-project.com/setuid?bidder=bidswitch&gdpr=&gdpr_consent=&us_privacy=&uid=5543a60e-e1c5-4845-9c71-a343412086e7
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Apr 2025 05:59:57 GMT

GET
H3 200 IWrxtS7IOcgjEMk18Kta_T4InJPDByS68Bvxf8TRoyE.js Show response
pagead2.googlesyndication.com/bg/ Frame 2BA3 54 KB
20 KB 136ms
136ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IWrxtS7IOcgjEMk18Kta_T4InJPDByS68Bvxf8TRoyE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-108-139-47-39.jfk50.r.cloudfront.net

Software

sffe /

Resource Hash

216af1b52ec839c82310c935f0ab5afd3e089c93c30724baf01bf17fc4d1a321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 445288
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 02:18:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 25 Apr 2025 02:18:28 GMT
last-modified: Thu, 24 Apr 2025 15:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20941
x-xss-protection: 0
server: sffe

GET
H2 200 cap
choices.trustarc.com/ Frame D569 43 B
432 B 145ms
143ms Image
image/gif 108.139.47.39
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://choices.trustarc.com/cap?aid=zetaglobal01&pid=zeta01&cid=101619&w=160&h=600&c=de97

Requested by

Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.47.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 5b4b6c6517b988a4ff2c794e5583ee02.cloudfront.net (CloudFront)
expires: Wed, 30 Apr 2025 05:59:55 GMT
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: tied4Ju8j61ng156qHiXtvcvFd65S5rWrPjkVeVYrGRMmlzh3cUMZQ==
date: Wed, 30 Apr 2025 05:59:56 GMT
x-xss-protection: 1; mode=block
content-type: image/gif
x-amz-cf-pop: JFK50-P1
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame FC07 2 KB
893 B 93ms
91ms Document
text/html 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?ix_um=1&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F&s=186779&gdpr=0
Requested by: Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01333ed4c08a35b8d83fbec9a079dc8fe6c31f23fcdfd8b6c6e837b40efebac2

Request headers

Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9384d0e2eaf1c213-LAX
content-encoding: br
content-type: text/html
date: Wed, 30 Apr 2025 05:59:56 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dJDzjIvMrJkCNwewJ5gaaLddRa592xB9BXLchSqZLXBddLF9hPNfuo8r5XVZwQMymkYaUTJGH9wnkxGQKEJUQf0AZO6uKB2JsSslqbGWyZx3TBrPeR6OYl3EGLyHLLrrNVFKh1KzaB%2BZBg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 864F 1 KB
643 B 136ms
136ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 804651cb231b488657bff183e519225d.safeframe.googlesyndication.com
URL: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 43181
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Apr 2025 18:00:15 GMT
etag: 48472445140208031
expires: Wed, 30 Apr 2025 18:00:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D569 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5602e585626389a392c0975b8d18fffc417c9b51ba5882ea1d76707ad999234f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D569 0
0 162ms
161ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D569 0
0 158ms
158ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://804651cb231b488657bff183e519225d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 30 Apr 2025 05:59:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D569 0
0 156ms
155ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS