www.getpaint.net Open in urlscan Pro
50.87.184.106 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.getpaint.net/
Effective URL:
https://www.getpaint.net/
Submission: On May 21 via manual (May 21st 2025, 6:45:34 pm UTC) from US — Scanned from DE

Summary HTTP 105 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 31 IPs in 6 countries across 19 domains to perform 105 HTTP transactions. The main IP is 50.87.184.106, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is www.getpaint.net. The Cisco Umbrella rank of the primary domain is 423779.
TLS certificate: Issued by R10 on May 13th 2025. Valid for: 3 months.

This is the only time www.getpaint.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	50.87.184.106 50.87.184.106	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1 1	142.250.185.68 142.250.185.68	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
24	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
1 1	151.101.1.21 151.101.1.21	54113 (FASTLY) (FASTLY)
1	172.64.153.163 172.64.153.163	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1 11	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2	142.250.185.142 142.250.185.142	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:81d::2001	15169 (GOOGLE) (GOOGLE)
2 3	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
3 5	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
2	172.217.18.1 172.217.18.1	15169 (GOOGLE) (GOOGLE)
2	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
4	88.99.219.174 88.99.219.174	24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
5	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1 4	138.201.64.38 138.201.64.38	24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
1 2	142.250.184.228 142.250.184.228	15169 (GOOGLE) (GOOGLE)
1	142.250.184.195 142.250.184.195	15169 (GOOGLE) (GOOGLE)
1 3	91.121.248.44 91.121.248.44	16276 (OVH OVH SAS) (OVH OVH SAS)
1	2a0b:4d07:101::1 2a0b:4d07:101::1	44239 (PROINITY ...) (PROINITY proinity GmbH)
1	18.133.130.200 18.133.130.200	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.185.198 142.250.185.198	15169 (GOOGLE) (GOOGLE)
1	2400:52e0:1e0... 2400:52e0:1e00::1080:1	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
2	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1	18.66.147.120 18.66.147.120	16509 (AMAZON-02) (AMAZON-02)
1	99.86.4.36 99.86.4.36	16509 (AMAZON-02) (AMAZON-02)
2	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:829::2001	15169 (GOOGLE) (GOOGLE)
2	13.43.191.164 13.43.191.164	16509 (AMAZON-02) (AMAZON-02)
105	31

18 50.87.184.106 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box2545.bluehost.com

www.getpaint.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.68 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.21 (San Francisco, United States) 1 redirects

ASN54113 (FASTLY, US)

www.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.153.163 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.186.34 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:81d::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.194 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f194.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.18.27.193 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.1 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 88.99.219.174 (Ahnsbeck, Germany)

ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: static.174.219.99.88.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.64.38 (Mannheim, Germany) 1 redirects

ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: static.38.64.201.138.clients.your-server.de

hal900011.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.228 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.121.248.44 (France) 1 redirects

ASN16276 (OVH OVH SAS, FR)
PTR: ip44.ip-91-121-248.eu

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:101::1 (Switzerland)

ASN44239 (PROINITY proinity GmbH, CH)

adv.office-partner.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.133.130.200 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-133-130-200.eu-west-2.compute.amazonaws.com

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2400:52e0:1e00::1080:1 (Germany)

ASN60068 (CDN77 Datacamp Limited, GB)

ad-server.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.147.120 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-120.fra60.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-36.fra6.r.cloudfront.net

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.43.191.164 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-43-191-164.eu-west-2.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 117 tpc.googlesyndication.com — Cisco Umbrella Rank: 184	538 KB
18	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 56 cm.g.doubleclick.net — Cisco Umbrella Rank: 314 ad.doubleclick.net — Cisco Umbrella Rank: 159 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 192711	85 KB
18	getpaint.net www.getpaint.net — Cisco Umbrella Rank: 423779	270 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 68544 hal900011.redintelligence.net — Cisco Umbrella Rank: 383915	61 KB
8	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 3 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 733 adservice.google.com — Cisco Umbrella Rank: 608	69 KB
5	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 415 ep2.adtrafficquality.google — Cisco Umbrella Rank: 424	26 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 54	7 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 730	3 KB
3	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 40330 api.webgains.io — Cisco Umbrella Rank: 122068	21 KB
3	medialead.de 1 redirects pv.medialead.de — Cisco Umbrella Rank: 72475	2 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 60	219 KB
2	gstatic.com www.gstatic.com fonts.gstatic.com	28 KB
1	webgains.team cdn.track.production.webgains.team — Cisco Umbrella Rank: 112866	3 KB
1	ad-server.eu ad-server.eu — Cisco Umbrella Rank: 131671	517 B
1	webgains.com track.webgains.com — Cisco Umbrella Rank: 110402	2 KB
1	office-partner.de adv.office-partner.de — Cisco Umbrella Rank: 237030	924 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 85
1	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 3146	3 KB
1	paypal.com 1 redirects www.paypal.com — Cisco Umbrella Rank: 3038	981 B
105	19

	Domain	Requested by
24	pagead2.googlesyndication.com	www.getpaint.net pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.google.com ep2.adtrafficquality.google
18	www.getpaint.net	www.getpaint.net
11	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
9	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com
5	fonts.googleapis.com	pagead2.googlesyndication.com hal900011.redintelligence.net
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
4	hal900011.redintelligence.net	1 redirects googleads.g.doubleclick.net hal900011.redintelligence.net
4	hal9000.redintelligence.net	googleads.g.doubleclick.net hal900011.redintelligence.net
4	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
3	ep2.adtrafficquality.google	pagead2.googlesyndication.com ep2.adtrafficquality.google
3	pv.medialead.de	1 redirects hal900011.redintelligence.net
3	cm.g.doubleclick.net	2 redirects googleads.g.doubleclick.net
3	www.google.com	2 redirects ep2.adtrafficquality.google
2	api.webgains.io	analytics.webgains.io
2	ep1.adtrafficquality.google	pagead2.googlesyndication.com
2	www.googletagmanager.com	adv.office-partner.de www.googletagmanager.com
2	5994599.fls.doubleclick.net	1 redirects www.getpaint.net
2	ad.doubleclick.net	googleads.g.doubleclick.net 5994599.fls.doubleclick.net
1	cdn.track.production.webgains.team	googleads.g.doubleclick.net
1	analytics.webgains.io	track.webgains.com
1	adservice.google.com	5994599.fls.doubleclick.net
1	ad-server.eu	googleads.g.doubleclick.net
1	track.webgains.com	www.getpaint.net
1	adv.office-partner.de	hal900011.redintelligence.net
1	fonts.gstatic.com	fonts.googleapis.com
1	www.googleadservices.com	googleads.g.doubleclick.net
1	www.paypalobjects.com	www.getpaint.net
1	www.paypal.com	1 redirects
1	www.gstatic.com	www.getpaint.net
105	29

This site contains links to these domains. Also see Links.

Domain
blog.getpaint.net
twitter.com
blogs.windows.com
lifehacker.com
web.archive.org
www.codinghorror.com
en.wikipedia.org
www.microsoft.com
bsky.app
www.download.com
fileforum.betanews.com
www.softpedia.com
www.hostingadvice.com
find.pcworld.com
www.dotpdn.com
adssettings.google.com
track.webgains.com
www.reachgroup.com

Subject Issuer	Validity	Valid
www.getpaint.ojl.bgg.mybluehost.me R10	`2025-05-13` - `2025-08-11`	3 months	crt.sh
*.g.doubleclick.net WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh
*.google.com WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh
tpc.googlesyndication.com WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh
*.doubleclick.net WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh
redintelligence.net E5	`2025-04-30` - `2025-07-29`	3 months	crt.sh
upload.video.google.com WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh
*.gstatic.com WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh
pv.medialead.de R10	`2025-03-29` - `2025-06-27`	3 months	crt.sh
adv.office-partner.de R11	`2025-04-20` - `2025-07-19`	3 months	crt.sh
*.webgains.com Amazon RSA 2048 M02	`2025-03-17` - `2026-04-16`	a year	crt.sh
*.google-analytics.com WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh
*.webgains.io Amazon RSA 2048 M03	`2024-06-24` - `2025-07-23`	a year	crt.sh
cdn.track.production.webgains.team Amazon RSA 2048 M03	`2024-07-30` - `2025-08-28`	a year	crt.sh
adtrafficquality.google WE2	`2025-04-29` - `2025-07-22`	3 months	crt.sh

This page contains 17 frames:

Primary Page: https://www.getpaint.net/
Frame ID: 1FCFFDEB0245E685143C958440B11104
Requests: 36 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20250520/r20190131/zrt_lookup_fy2021.html
Frame ID: 565E0E0ECCD3DB399B2CF85A2B408CD8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=280&adk=3788282855&adf=3717182569&w=336&lmt=1747702613&channel=1615128010&ad_type=text_image&format=336x280_as&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=124&bdt=319&idt=95&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&correlator=6553910538074&frm=20&pv=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=428&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=467
Frame ID: 39189F33E4D249D9448803D83FAD55B4
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=250&adk=2767849875&adf=3946381816&w=250&lmt=1747702613&channel=2834294182&ad_type=text_image&format=250x250_as&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=119&bdt=319&idt=150&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=913&ady=286&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=473
Frame ID: F3E02746C49562D53BCCB9D89F7B5513
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484
Frame ID: 6E7A5BAD4B67B138725F1EEB02637326
Requests: 24 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&adk=1812271804&adf=3025194257&abgtt=8&lmt=1747702613&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=404x1080_l%7C404x1080_r&channel=1615128010&format=0x0&url=https%3A%2F%2Fwww.getpaint.net%2F&pra=7&wgl=1&aihb=0&asro=0&aifxl=29_18~30_19&aiapm=0.15&aiapmi=0.16&aiact=0.7&aicct=0.7&ailct=0.6348085447928734&aimart=8&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=2&bdt=319&idt=154&shv=r20250520&mjsv=m202505150101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as%2C728x90_as&nras=1&correlator=6553910538074&pv_ch=1615128010%2B&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fsapi=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&fsb=1&dtd=489
Frame ID: E57B4F71DF518FB8498D83D6463727C2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX9IwtQ4LwFUzqs0n_xSoEQgLmYGdMMH-KVjHbt5vHHTNUG0-JECqgfXjbGUJPskM6qDaeQc_4mnUscg1D4bgrbYnafZSNPMg281P-ioSs27tpow_I
Frame ID: C97634A434EDD1F12A2D6B2F06DA6856
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: A6FE8647EF023F893418EC3EF36DA0DE
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 2E0B407FA17565A4C855227E7722E08E
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/HVfYMg_tbqFPscqlZMGL1byfcR9ERNJ18Ev-pBY5zHk.js
Frame ID: CCE59E27027BF0EACD3A5F0C671B47F3
Requests: 1 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e5873f6bc5749724bd084?subid=96568000171247804444550013062011&gdpr=1&consent=1&gdpr_consent=CPOBKPOPOBKPrCnABCDEBwCsAP_AAAAAAAYgH4pd9D7dbXFDefx9Wvt0OYwW1tBXC-QCChSBA2AFQAGQ8LQAk0EaMATAhiACEQIAolIBAAEkHAFEAEAQQIAEAAHsAgSEhAAKIAJEGBERAAIQAAoKAAAAAAAIgABBqASAmAiQS9buRUAAuIgwRApIgAgBCIBHAoMBQAAIAAAIAAIAAACQ0A4AKwAXABDAD8AIKAWkBF4CRAE7AKRAYeAxgBnwDlBUA0AIYATAAuACOAH4ARwAtICQQExALzAYeAz4Byg6COAAsACoAGQAOQAfACAAFwAMgAaAA8AB9AEMARQAmABPACtAFwAXQAvgBiADMAG8AOYAfoBDAESAI4ASwAmABNACjAFKALEAW4AwwBlADRAHtAPsA_QCBgEWAI4ASkAsQBaYC5gLqAXkAxQBtADcAHEAOoAegBDYCLwEggJEATsAocBeYDBgGHgMSAYwAyQBlQDLAGfANOAawA4sBygDowHjgPxIQIAAFgAZABcAEMAJgAXAAvgBiADMAG8ARwAsQBlQD7APwAjgBKQChgFpALmAYoA2gB1AD0AJBASIAk4BbQDDwGJAM-AdGA8clAjAAQAAsADIAHAAPgA8ACIAEwALgAXwAxABmADbAIYAiQBHACjAFKALcAZQA1QB-AEcAJOAWkAuoBigDcAHUAReAkQBeYDDwGWAM-AawEgbAAIAAWABUADIAHIAPABAADIAGgAPIAhgCKAEwAJ4AVgA3gBzAD8AISAQwBEgCOAEsAJoAUoAtwBhgDVAHtAPsA_QCBwEaARwAlIBcwDFAG0ANwAcQA9ACGwEXgJEATEAnYBQ4CkQF5gMGAYeAyQBnwDTgGsAOCAcoA6MB44iAUAFYAQwA_AEXgJEATsApEBh4DPgHKDIBYAQwAmACOgH2AfgBHAEnAJiAXmAw8BnwDlCkDIABYAFQAMgAcgA-AEAAMgAaAA8gCGAIoATAAngBSAC-AGIAMwAcwA_QCGAIkAUYApQBYgC3AGUANEAasA-wD9AIsARwAlIBQwC5gF5AMUAbQA3AB6AEXgJEAScAnYBQ4C8wGHgMYAZIAz4BrADggHKAPHA.f_gAAAAAAMAA
Frame ID: EBE019A2467A3DDF4A2B507C299BDFC6
Requests: 1 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/f4cf242caee16dc1ec9b128af4cd10fa?subid=96568000171247804444550013062011&gdpr=1&consent=1&gdpr_consent=CPOBKPOPOBKPrCnABCDEBwCsAP_AAAAAAAYgH4pd9D7dbXFDefx9Wvt0OYwW1tBXC-QCChSBA2AFQAGQ8LQAk0EaMATAhiACEQIAolIBAAEkHAFEAEAQQIAEAAHsAgSEhAAKIAJEGBERAAIQAAoKAAAAAAAIgABBqASAmAiQS9buRUAAuIgwRApIgAgBCIBHAoMBQAAIAAAIAAIAAACQ0A4AKwAXABDAD8AIKAWkBF4CRAE7AKRAYeAxgBnwDlBUA0AIYATAAuACOAH4ARwAtICQQExALzAYeAz4Byg6COAAsACoAGQAOQAfACAAFwAMgAaAA8AB9AEMARQAmABPACtAFwAXQAvgBiADMAG8AOYAfoBDAESAI4ASwAmABNACjAFKALEAW4AwwBlADRAHtAPsA_QCBgEWAI4ASkAsQBaYC5gLqAXkAxQBtADcAHEAOoAegBDYCLwEggJEATsAocBeYDBgGHgMSAYwAyQBlQDLAGfANOAawA4sBygDowHjgPxIQIAAFgAZABcAEMAJgAXAAvgBiADMAG8ARwAsQBlQD7APwAjgBKQChgFpALmAYoA2gB1AD0AJBASIAk4BbQDDwGJAM-AdGA8clAjAAQAAsADIAHAAPgA8ACIAEwALgAXwAxABmADbAIYAiQBHACjAFKALcAZQA1QB-AEcAJOAWkAuoBigDcAHUAReAkQBeYDDwGWAM-AawEgbAAIAAWABUADIAHIAPABAADIAGgAPIAhgCKAEwAJ4AVgA3gBzAD8AISAQwBEgCOAEsAJoAUoAtwBhgDVAHtAPsA_QCBwEaARwAlIBcwDFAG0ANwAcQA9ACGwEXgJEATEAnYBQ4CkQF5gMGAYeAyQBnwDTgGsAOCAcoA6MB44iAUAFYAQwA_AEXgJEATsApEBh4DPgHKDIBYAQwAmACOgH2AfgBHAEnAJiAXmAw8BnwDlCkDIABYAFQAMgAcgA-AEAAMgAaAA8gCGAIoATAAngBSAC-AGIAMwAcwA_QCGAIkAUYApQBYgC3AGUANEAasA-wD9AIsARwAlIBQwC5gF5AMUAbQA3AB6AEXgJEAScAnYBQ4C8wGHgMYAZIAz4BrADggHKAPHA.f_gAAAAAAMAA
Frame ID: A9F8F033FF9768FF76298F1505C2832A
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: EB482A083D503AC241D6F32B1044ADF1
Requests: 3 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364
Frame ID: 751F8A2B5E6CA5657B325B8A5D11DA19
Requests: 3 HTTP requests in this frame

Frame: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140
Frame ID: 47BC88AB49B6DDD59D2830B1DA9B9701
Requests: 6 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html
Frame ID: 8030ED94826279CC37B4FE2758F373C9
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe?hl=en
Frame ID: 44E4BF2EAD1F52AA282E0093CEA360C5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Paint.NET - Free Software for Digital Photo Editing

Page URL History Show full URLs

http://www.getpaint.net/ HTTP 307
https://www.getpaint.net/ Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

Page Statistics

105
Requests

93 %
HTTPS

25 %
IPv6

19
Domains

29
Subdomains

31
IPs

6
Countries

1330 kB
Transfer

3275 kB
Size

17
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://blog.getpaint.net/
Title: Blog

Search URL Search Domain Scan URL

URL: https://twitter.com/rickbrewPDN

Search URL Search Domain Scan URL

URL: https://blogs.windows.com/windowsdeveloper/2022/05/27/announcing-the-microsoft-store-app-awards-winners/

Search URL Search Domain Scan URL

URL: http://lifehacker.com/5548767/lifehacker-pack-2010-our-list-of-essential-windows-downloads
Title: Lifehacker

Search URL Search Domain Scan URL

URL: https://web.archive.org/web/20170102142248/http://www.pcworld.com/article/131935/article.html?page=3
Title: Top 100 Products of 2007

Search URL Search Domain Scan URL

URL: https://www.codinghorror.com/blog/archives/000993.html
Title: Coding Horror

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Ms_Paint
Title: Microsoft Paint

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Photoshop
Title: Adobe® Photoshop®

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Paint_Shop_Pro
Title: Paint Shop Pro®

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/GIMP
Title: The GIMP

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/store/apps/9NBHCS1LX4R0?ocid=pdn_www_index_right

Search URL Search Domain Scan URL

URL: https://bsky.app/profile/rickbrew.bsky.social
Title: Bluesky

Search URL Search Domain Scan URL

URL: http://www.download.com/Paint-NET/3000-2192_4-10338146.html

Search URL Search Domain Scan URL

URL: http://fileforum.betanews.com/detail/PaintNET/1096481993/1

Search URL Search Domain Scan URL

URL: http://www.softpedia.com/reviews/windows/Paint-NET-Review-48912.shtml

Search URL Search Domain Scan URL

URL: https://www.hostingadvice.com/blog/paint-net-delivers-free-photo-editing-software/

Search URL Search Domain Scan URL

URL: http://find.pcworld.com/56879

Search URL Search Domain Scan URL

URL: https://www.dotpdn.com/
Title: dotPDN LLC

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJEQ9w82Hjt4TNi7B83qrmdSTjilQmuE_vAHcCpMLLb08kc7LM0xVSVLRgVGgKFGtR1SCcrSbqEjsgIAI6-2NUZryJX765LGbckbFO5aiC_wTgjFrPXD810UbrQb9KPWlAio-Wk5OOAX1IDcUl3dInn2Qx3XQIjewCIvSDLM4vDKTHjgztGbSGRi0tgiDQTJA4ZahA92GOLwWUaPIalSduHCpFLZf7xD4ka9orKOOFUh_rs17jt_JYmZlskeuevVApaKtSbREb4FTcB20-hX6-4nbtJkota1JvDtDAZ4hxuWqIy8sq5VLpDXePPKNqYWdqOof-wYXsMhL_Y0CuGu5CvmciFp4XkIA9l8NcR0wMawh9iJJcWMQCdmCVhYIlilp4MuzP1pTdY-MLEAUQbZtkpPKuDWGw3Emc-xlj6MTEcZSEqzQxneWMUw7UFrWt7nn21ZqE-MiU-0WYbklb522g6HCKfAEalbh5LTTjCdrMBehQGcNSYWoak5Qc8KwxRw_tUW5Ok2S5nxrBAdcQgpRgtcECQs6qXltoNRXRZ55fOOa5ufy312WU9Lgs0srsbh4jIVHK066G9EImGzs0OhMubM_VWlGa-uu5J-dg5cnaUl7TwbUwfbKLjpoMgINIFexN0EtcipteZk8HG-Whon5ypKInTk_bkIbZIDe9vCYrt2yVv7GosuKO4e5C8BohuPM_47vLoF28v3jpbKwcCBr2DT92J6f5spSYsVabefn3KYDDNEHVERmEf39vQmt0RvQSFxP2K82IYcLGdocW34_Pjd8qC66UiZRhBzZ3J03s-mJRVkVoCvoJR-lslklXQq5fDRtfv6MyGonA3leLPFooh5GmnKog4962MIiOFr-Gut0xHXMAyvJOS3P0kxVAkAhmSNvtAMx6nlZ7nNq2AwHVLR679mvdhsOtKob9E3lOSBKzs0XGWe32LKPRSRrO9QS4p3MPb-WV2L9SxP5vF91PhOU3mX_NESvAvF01r0qicBnyF7lJ4o5VVcYFOcSQ95iG2v9VjrNq0quwQQOF2sW8_L2aDGLtvx_eWYfaDw9hKfSw36k2IFOkuOb375rY8ZKHEK8RMaAWCNAYaRWrYFeWsZGvvOFVqzjRlBgsTeAM1xw6p8AOfB0W-zYYwcaAWUSof_meUfIxeOXBETfi2vE6Cv_2EkgAUQP2tqkUxtOmaiUIKu5Bn1E8h-Oa0pnnvOIVnfP69i3uvkarqnCZmOsJFQ_4qtj3f1qMnSskKHW39iaarDTBfzGZgRjI7Q-mYeLRni2l31WnZKeAhWcxEtOfCizyW5zWDS1AVJpeAWt1B6O7Mwg-2yQcoQ0mvp8N2LGrFyZicC_bMdWZ0H1S-5LNcIEnxUstZ-EzGfYQuvp8EzBjphszSUZvugMYeR0hqj07rsUJylzUctMDN-GM24BQKKeWvBvE6mkqT1IQ37Q539z3GJ48Nzrh88mUQ40xLMOPWswvMqiPpRtTfdOmadGgwq0IIWiuUVejGEm1hXDQU7Uzgq9CTXLq-Vu_1QNplBd5wyGz_xUGV4WJATT5ZKqqofMBTdEqgfrAeb3aJYTA-Frdbho_E-eGIMO8qa6kTsT1V_8iTZ-OZFVaihG77ffYogBFLRxgy3R1X66Tct3oJ8QU1AYytMU_ubr00ulMWyG6vWdQeY7yd2bYzB5UKeVqgmcwsFpikZ_INv6_O0v4E3GmnfAR3p301wqygoB8ETAwJqbXsD-_gsNvS5NEyqKEnCUwt-IEFpXPEdh6lDUPkLnkvNq2OgyMUcdik2WAdxkVgfyN8E8Bx6LAzLwVF4mfL2aYf-0QhoR7ThS0BXWsuYFXUaibSkN1OgWGkOqRdV4J6p_ZLES3GwI_SOUia1opnYqEGANoX5B6ji0QP3mQ7vDOMcMpVmyDnqPOrf_aKho3l7wXD6qO6rPHEt8UHor9gY58s-evcLvJ7jkar_N_ywVAl_4lfjR9Hk10ORF0gmV9uHGX-81K5Dx5oARbnLeQcLlFThKtSbxaodvA1WLCEiFniXC0dGkj3z3du417v-FrG35Ji2R_5M8P2HWIrJi20911EmA7pk&opi=122715837

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJESSDDV9EW_Ng3FYmXCBQOMoq9XKv9Jg8eyqblZZnfuzt9PefZPWHQx8kS5Ey2YmBBQOHPc-m65hyGkj6cFk6TwV8gcC0mXxULz6egVAPp1qPN4HF0RNsF6zgxnvBy1yvU_RLsuEErmKG-P0ggzbdC0TUn83nvKYXKJAsPVeaRPYj835W-Num-rQPTVcTJ3EFllwBG2GClI_9w8ZJ8NNSwky4Tut9deaUENKmXOKdsGlc8fOzCMu9J7m37DADhnfaJ4u1MEzQC3WyqoQ0_hkCWpdenPQZaL5RUdgJWKTCGQrPGR7Ab2lx9Dj8S0LSAFVCnyJDVFLKjU4Pne7NSE18vQMITMVTeelnEdmOiDdT6sgkr2d_fNFQQ-minm4_n_mz0H03n_jLjBumqpwEJETEBsKSKal5RSCoVw5Q9XvyVXpY6wEoWl9MCf__hYsb6WjsYmI3YUzIVZZ4_8oGN4Q1RabUC7LT3A-DcEi25WHnww_gynmoghAeIc6qxU50ov6_7Pm3DwxDBcL1ynj1GGyYk_aaCLkNf_ddneqDOPMkHUsj04xZxP5ZrhUDDeZv9qbqMxI68xYRSQ3ZX3hDpbtAkT_U4c4hCKGJvk1YtYXG57mD67Pe87G-w4VCvjJJWdRrWRn_a9U8UnIFV88e2O63TuGTXGChf9NendQlB16V3XJqCwuKhlBGXs5f2xlIFK-lR7I165NHeFtOek6phyJsqu1xyEVThYDQS4Uep_UlcZMvJIw9MJKqSu7T_ARVd9MYu-k0pEdL_hOoeGvDxToLQam7XySJ0kjiNw7mCJht0rVRJXsn17YnUzqtAungC6NmI4jklQqxnTlQSrD8WcN0nxViVWRjPnkFFIMYu3CS9VXzXrwU0scjEqoUE9EkEg2jC3HTLfs6mEH8KyVT2Fc0lkKCMbL_Nuc8uONd89d3vV01sGWaO-sb864v2iVOupzpY2ZtwDRExNo6S9dXTGJl53aoSz62tngm7ch57bRjSsbRo2Jdj1jIyUc_31iR6oN7gNCXEKwGhZAJ409LM3OWGWXbdfC9H0hBKf4FL1rmFwx0DBa6enEBtTc_hsV_wECrwyQdNaBpNTmGylEEIaLDeMvIqPZwR6PeV_mQayn-mLl2ICOk_-kLb_0FbJNMhn4Hau7fbcnvE69kXHruZd6WsvzT4F3ZuGPMxP8o2v-qdmDCmPOg6SJjVq4lOlRE2pSR3kttCGjAVnrG6zCfpRxrYuxk7OBfjZf3rklumFLRRtWvwk5ix8EGZ_zaKL8RrcIGslihh9EBY4NUHnXpDPn1BbFXW7ebOVWJGxUA9qnwlFnOqUwv1CTIWO71D7K0lAaqd00nIMUpusaBM8N1S2m_4p0pkmL8PlWK3xdBNe6_4bU7FsJWatC32HE1RlckCnH2Pvam5lj39DzN5Ip66fH3eK9l0Uac0KTrJuPHLdsgsnm88-wV3_nYuRCwR3eVtwo7ixgh9NwgSloBlY3mOHVVKfK51rDjQEbwffV0AP3Xqj7oNS4m_zl0aiiahJOhWeTUbXMqFr1EH-OfOtYXAfHCDhuihUTIGoY8WYC6FoXQeotIHUv1bgOxqAPlKYf6wWI9el9cAQOoGC4K8Rqcxno9Qo9gVFhL76N55R_4Ab1mWRMZ1fLbknLcOAGR1amqjPXW_Wnrk3MEwEkLkSkMiu05ooUvyD7N_vw2G3Z4J1WHn375h2AIT3ADk9CGHwmQ52OK5i_h57f4rht4tigkfKNEdXb1nNn6r4XEng2vzEGKtVS8TX1V1lOCzaDfnat8wcuc54ckXSxKLhZwvBU63yHEgb97LfMnLfwGi9IXts7Kx_cgrmgbMDGkulka3Nw0YDwTzF8r4cJbs_K7tUSsfahb0Aq5WazFFWeAA&opi=122715837

Search URL Search Domain Scan URL

URL: https://track.webgains.com/click.html?wglinkid=2513135&wgcampaignid=99582&wgtc=1747853137-7121-99582&origsource=https://www.getpaint.net/&clickref=

Search URL Search Domain Scan URL

URL: https://www.reachgroup.com/
Title: TRG

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.getpaint.net/ HTTP 307
https://www.getpaint.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://www.google.com/coop/cse/brand?form=searchbox_017811919762320179081%3Achfn-2g_cbg HTTP 301
https://www.gstatic.com/prose/brandjs.js

Request Chain 11

https://www.paypal.com/en_US/i/btn/x-click-but04.gif HTTP 301
https://www.paypalobjects.com/en_US/i/btn/x-click-but04.gif

Request Chain 37

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0&C=1

Request Chain 38

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgdpr%3D0%26google_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=casale_media2_dsp_secure&google_cm&google_hm=aC4fULmqPU8AIq54AhPFWgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0

Request Chain 48

https://googleads.g.doubleclick.net/pagead/adview?ai=CgKO1UB8uaPC1A_TUiM0Prc_PYOaRooR_6ee3qKgU29keEAEgtuHZBGCVgoCAsAegAZyv-6gCyAEDqAMByAPJBKoEygFP0EweI8uzo_T20Zwib5VYEzaJ4pPmC1pPgmtPg5R7EByr87NdK2XrPv7SbkqbUBbL0PfdViUuVZzmwS8aX5Zpx7qbu-3O1PmX80dRVbrp4f9Wv-iz495xp0Ily8xhb3ra_fLJiND2STIphXERIYBdkD-47jqs9fFlHbf_zv7SoHSDFZ7FXIoZQ2LcG961kwVhaZlXNCYi2A8aj8U_GC5mFthLcn58UAHUsEXL2tdVCVcRL4jQSXU3ALvH2DdZ2JnM8ww_3XburduPwAS-iP6lgAWIBd_dx6pSkgUECAQYAZIFBAgFGASgBgOAB8zQhNcBqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwHyBwQQ4ulR0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpYpIOsqpy1jQOaCYkCaHR0cHM6Ly93d3cuaGVyby13YXJzLmNvbS8_ZGVsYXllZHNpZ251cD10cnVlJm54X3NvdXJjZT1hZHhfYWR3b3Jkc2Rpc3BsYXkuaHdfd2JfdWZfLS5jYy13d19kZV9lbi5nLW1peC5hLW1peC5hdS1sYWwub3B0LXB1cmNoYXNlMi5jci1od19zdF9sb290d29tZW45Yl9naWYuY24tMzAwXzI1MC5scC1kZWxheWVkLmR0LWRpc3BsYXkuY2lkLTIyMTAwOTYzMDM5LmFnaWQtMTcxODc4MzUxOTM0LmNzZC0xNTA1MjUuLSZhaWQtNzUyMjMyNjE3MTc4JmdhZF9zb3VyY2U9NYAKAcgLAeoNEwjN5dCqnLWNAxV0KqIDHa3nEwzYEw3QFQGYFgH4FgGAFwGyFyAKGggAEhRwdWItNDM0Mzg1MTMzMDUxMDI3NhgAGAEqALoXAjgBshgJEgKwUxgDIgEA0BgB6BgB&sigh=t3-f8WOQyKQ&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgDZpuyzsLNSNGb5V3mMtvj9QqkHqzpNk9FLn1PTjPCRIgxEEgtgNAtaateniOyqMoobQkPunCfJW5mW9FWXO3n_x_57ShebjIL_Jp3p1BgB&vis=1&ebtr=1&nis=6 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228615651770236381502%22,%22debug_reporting%22:true,%22destination%22:%22https://hero-wars.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22622778268%22],%2222%22:[%22true%22],%224%22:[%2205-21%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224621936173959417937%22}&andc=true

Request Chain 63

https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 65

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 74

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364

Request Chain 76

https://pv.medialead.de/trck/eview/e99aace94e6e5873f6bc5749724bd084?subid=96568000171247804444550013062011&gdpr=1&consent=1&gdpr_consent=CPOBKPOPOBKPrCnABCDEBwCsAP_AAAAAAAYgH4pd9D7dbXFDefx9Wvt0OYwW1tBXC-QCChSBA2AFQAGQ8LQAk0EaMATAhiACEQIAolIBAAEkHAFEAEAQQIAEAAHsAgSEhAAKIAJEGBERAAIQAAoKAAAAAAAIgABBqASAmAiQS9buRUAAuIgwRApIgAgBCIBHAoMBQAAIAAAIAAIAAACQ0A4AKwAXABDAD8AIKAWkBF4CRAE7AKRAYeAxgBnwDlBUA0AIYATAAuACOAH4ARwAtICQQExALzAYeAz4Byg6COAAsACoAGQAOQAfACAAFwAMgAaAA8AB9AEMARQAmABPACtAFwAXQAvgBiADMAG8AOYAfoBDAESAI4ASwAmABNACjAFKALEAW4AwwBlADRAHtAPsA_QCBgEWAI4ASkAsQBaYC5gLqAXkAxQBtADcAHEAOoAegBDYCLwEggJEATsAocBeYDBgGHgMSAYwAyQBlQDLAGfANOAawA4sBygDowHjgPxIQIAAFgAZABcAEMAJgAXAAvgBiADMAG8ARwAsQBlQD7APwAjgBKQChgFpALmAYoA2gB1AD0AJBASIAk4BbQDDwGJAM-AdGA8clAjAAQAAsADIAHAAPgA8ACIAEwALgAXwAxABmADbAIYAiQBHACjAFKALcAZQA1QB-AEcAJOAWkAuoBigDcAHUAReAkQBeYDDwGWAM-AawEgbAAIAAWABUADIAHIAPABAADIAGgAPIAhgCKAEwAJ4AVgA3gBzAD8AISAQwBEgCOAEsAJoAUoAtwBhgDVAHtAPsA_QCBwEaARwAlIBcwDFAG0ANwAcQA9ACGwEXgJEATEAnYBQ4CkQF5gMGAYeAyQBnwDTgGsAOCAcoA6MB44iAUAFYAQwA_AEXgJEATsApEBh4DPgHKDIBYAQwAmACOgH2AfgBHAEnAJiAXmAw8BnwDlCkDIABYAFQAMgAcgA-AEAAMgAaAA8gCGAIoATAAngBSAC-AGIAMwAcwA_QCGAIkAUYApQBYgC3AGUANEAasA-wD9AIsARwAlIBQwC5gF5AMUAbQA3AB6AEXgJEAScAnYBQ4C8wGHgMYAZIAz4BrADggHKAPHA.f_gAAAAAAMAA HTTP 302
https://ad-server.eu/wm/pb/native.png

Request Chain 98

https://www.google.com/recaptcha/api2/aframe HTTP 307
https://www.google.com/recaptcha/api2/aframe?hl=en

105 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.getpaint.net/
Redirect Chain

http://www.getpaint.net/
https://www.getpaint.net/

16 KB
7 KB

562ms
179ms

Document
text/html

50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to

Full URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 82660ff4649dd25de7a5119726a5876433ef79e41d94456f3f70d93ce780f1a0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 7261
content-type: text/html
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Tue, 20 May 2025 00:56:53 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

Location: https://www.getpaint.net/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 pain1011-65001.css
www.getpaint.net/_themes/paint-net-theme/ 38 KB
8 KB 177ms
175ms Stylesheet
text/css 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to

Full URL: https://www.getpaint.net/_themes/paint-net-theme/pain1011-65001.css
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: a1d01a37fe3411099136b3fbbc9d2cc918bbe6164f9184e9a1cc4e24f614cd7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
accept-ranges: bytes
content-length: 7927
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Fri, 28 Dec 2007 09:11:57 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 Logo4.png
www.getpaint.net/images/ 6 KB
6 KB 164ms
163ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/Logo4.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 38dc9bc2f3a585d4b754d9119fb3b2a109d1329b401a203583b278ecf9e75561

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 6565
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Thu, 15 Aug 2013 23:31:42 GMT
content-type: image/png
server: Apache

GET
H2

200

brandjs.js Show response
www.gstatic.com/prose/
Redirect Chain

https://www.google.com/coop/cse/brand?form=searchbox_017811919762320179081%3Achfn-2g_cbg
https://www.gstatic.com/prose/brandjs.js

14 KB
6 KB

66ms
20ms

Script
text/javascript

2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/prose/brandjs.js

Requested by

Host: www.getpaint.net
URL: https://www.getpaint.net/

Protocol

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
age: 55869
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
x-content-type-options: nosniff
expires: Thu, 22 May 2025 03:14:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 03:14:26 GMT
last-modified: Tue, 06 Apr 2021 15:14:29 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
content-length: 5807
x-xss-protection: 0
server: sffe

Redirect headers

cache-control: public, max-age=1800
location: https://www.gstatic.com/prose/brandjs.js
age: 194
x-content-type-options: nosniff
expires: Wed, 21 May 2025 19:12:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 237
x-xss-protection: 0
date: Wed, 21 May 2025 18:42:21 GMT
content-type: text/html; charset=UTF-8
server: sffe

GET
H2 200 twitter_14x.png
www.getpaint.net/images/ 454 B
508 B 625ms
621ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/twitter_14x.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 76494fc583ed81567523f7e7443af01eefc61c87a09314528e8ef91c95ea3076

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 454
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Fri, 05 Apr 2019 17:08:16 GMT
content-type: image/png
server: Apache

GET
H2 200 hline_left.png
www.getpaint.net/images/ 94 B
147 B 164ms
161ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/hline_left.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 4514e63d4ca83723f25d5fb3359e81d630f05a79a8f6e992f8fb7a6b230600bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 94
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Thu, 23 Aug 2007 04:21:48 GMT
content-type: image/png
server: Apache

GET
H2 200 hline_center.png
www.getpaint.net/images/ 94 B
124 B 625ms
622ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/hline_center.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: cc5e49811a56d06c88d67c66e7f9890f27b645d5b7567a81a17ab334c0a4415d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 94
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Thu, 23 Aug 2007 04:21:48 GMT
content-type: image/png
server: Apache

GET
H2 200 hline_right.png
www.getpaint.net/images/ 94 B
124 B 624ms
621ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/hline_right.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 711430320097c0798702214a32954148a32ff546941a6eadd870ab49d18c3213

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 94
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Thu, 23 Aug 2007 04:21:48 GMT
content-type: image/png
server: Apache

GET
H2 200 2022_store_winner_900px.png
www.getpaint.net/images/ 42 KB
42 KB 165ms
161ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/2022_store_winner_900px.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 1737c65ad31e5ea7b1cbd8391c03c57c99ac1bca012d2f5a064b137db449465f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 43276
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sat, 20 Aug 2022 18:23:42 GMT
content-type: image/png
server: Apache

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 25 KB
10 KB 94ms
28ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: www.getpaint.net
URL: https://www.getpaint.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

c55500628a927bb87d2377a685e83c7ef50f73f6339f7ddafb303e82901aeb9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: br
etag: 17909525527482096971
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 18:45:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 10274
x-xss-protection: 0
server: cafe

GET
H2 200 pdn513_thumb.jpg
www.getpaint.net/screenshots/ 175 KB
175 KB 163ms
160ms Image
image/jpeg 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/screenshots/pdn513_thumb.jpg
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 716e877e57b348fb21a9f741ad7834a97a2dc2ab6d152411328ce0324cfa37e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 179443
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sat, 08 Feb 2025 20:56:01 GMT
content-type: image/jpeg
server: Apache

GET
H2 200 icon16x16_v3.png
www.getpaint.net/images/ 652 B
683 B 625ms
622ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/icon16x16_v3.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 55ce84013276e0eab96b4c52bea296c27c3c9c095c80bb534ac65064c0f6a156

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 652
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Thu, 23 Aug 2007 04:21:48 GMT
content-type: image/png
server: Apache

GET
H2

200

x-click-but04.gif
www.paypalobjects.com/en_US/i/btn/
Redirect Chain

https://www.paypal.com/en_US/i/btn/x-click-but04.gif
https://www.paypalobjects.com/en_US/i/btn/x-click-but04.gif

2 KB
3 KB

98ms
37ms

Image
image/gif

172.64.153.163
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://www.paypalobjects.com/en_US/i/btn/x-click-but04.gif

Requested by

Host: www.getpaint.net
URL: https://www.getpaint.net/

Protocol

Server

172.64.153.163 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8f36837d21e73e1a17fa2936ec161187b3d1e6b08c0335433aec8153cd41049

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

paypal-debug-id: 07434592162b3
cf-bgj: imgq:85,h2pri
etag: "5d5637bd-84f"
age: 2013
cf-cache-status: HIT
x-content-type-options: nosniff
traceparent: 00-000000000000000000007434592162b3-a629b22317d7774c-01
cf-polished: status=not_needed
dc: ccg11-origin-www-1.paypal.com
date: Wed, 21 May 2025 18:45:35 GMT
content-type: image/gif
last-modified: Fri, 16 Aug 2019 04:57:33 GMT
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
cf-ray: 94363b51cab628aa-AMS
pp-border: ccg14bdrf5-5.ccg14.slc.paypalinc.com
accept-ranges: bytes
content-length: 2127
server: cloudflare

Redirect headers

paypal-debug-id: f930837e7ef15
origin-trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
traceparent: 00-0000000000000000000f930837e7ef15-9dd1181906077a76-01
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-cache: MISS, MISS, MISS, MISS
date: Wed, 21 May 2025 18:45:35 GMT
x-served-by: cache-toj-leto2350045-TOJ, cache-toj-leto2350053-TOJ
x-cache-hits: 0, 0, 0, 0
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=0, no-cache, no-store, must-revalidate
location: https://www.paypalobjects.com/en_US/i/btn/x-click-but04.gif
accept-ch: Sec-CH-UA-Full
x-timer: S1747853135.348240,VS0,VE208
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-length: 0

GET
H2 200 getitfrommsft_152x55.png
www.getpaint.net/images/ 3 KB
3 KB 1058ms
1056ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/getitfrommsft_152x55.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 52335a2acd1c6dac7571132b6ada80e4f854ff592fc35333aa27ce83c7f3b27f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 2803
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sun, 31 Mar 2019 21:13:55 GMT
content-type: image/png
server: Apache

GET
H2 200 feed-icon-12x12.png
www.getpaint.net/images/ 489 B
520 B 1058ms
1056ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/feed-icon-12x12.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 40d05c659dc6a4356d13d97cdcb989dd708cc48c91ff9eedb2c65e80e8bcd2b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 489
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Thu, 23 Aug 2007 04:21:48 GMT
content-type: image/png
server: Apache

GET
H2 200 cnet_5stars.png
www.getpaint.net/images/ 3 KB
3 KB 893ms
891ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/cnet_5stars.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 21ed7729df820fb932de2e8945df88577acb274de09d25c38e4a857e833f89a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 2912
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Thu, 23 Aug 2007 04:21:35 GMT
content-type: image/png
server: Apache

GET
H2 200 linkbutton_editorspick.gif
www.getpaint.net/images/ 4 KB
5 KB 893ms
892ms Image
image/gif 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/linkbutton_editorspick.gif
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 0b063c61c371f585f55c65d3984b3a5cbba9587b7e05b05035ad46628bda11e1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 4590
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sun, 22 Apr 2007 21:14:26 GMT
content-type: image/gif
server: Apache

GET
H2 200 softpedia_5stars.gif
www.getpaint.net/images/ 4 KB
4 KB 893ms
892ms Image
image/gif 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/softpedia_5stars.gif
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: b3afa1e54d5383084054107daa76bb0b3d8055068610eedca3ec7308fea81319

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 3701
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sun, 22 Apr 2007 21:14:26 GMT
content-type: image/gif
server: Apache

GET
H2 200 hostingadvice_devschoice.png
www.getpaint.net/images/ 8 KB
8 KB 891ms
890ms Image
image/png 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/hostingadvice_devschoice.png
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: c08902c3d0dc41d8abf9b9f07bddd9d2efb5c8aa5ed0057b1bb0520d1ea815ff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 7889
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Fri, 07 Dec 2018 22:41:39 GMT
content-type: image/png
server: Apache

GET
H2 200 pcworld_may2k7.gif
www.getpaint.net/images/ 6 KB
6 KB 1057ms
1056ms Image
image/gif 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to Show image

Full URL: https://www.getpaint.net/images/pcworld_may2k7.gif
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: 5805f32624dbca80e736d3923c1850f68324439444943173d94e25be31d1508d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

accept-ranges: bytes
content-length: 5786
date: Wed, 21 May 2025 18:45:35 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sun, 22 Apr 2007 21:14:15 GMT
content-type: image/gif
server: Apache

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 153 KB
52 KB 73ms
72ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

b603f5e9cdcaef60acdb78cb0aea63e47738d8dee4fc966b55290fbc5fd430fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: br
etag: 3193710310440914425
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 18:45:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52865
x-xss-protection: 0
server: cafe

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202505150101/ 458 KB
154 KB 57ms
57ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202505150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4343851330510276&plah=www.getpaint.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

428c0da7fa6442eef8923695dcc99c5eb4a049b44109e78076cb3900b13ecfd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: br
etag: 11458255226639731865
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 18:45:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 157528
x-xss-protection: 0
server: cafe

GET
H2 200 pub-4343851330510276 Show response
fundingchoicesmessages.google.com/i/ 200 KB
65 KB 242ms
45ms Script
application/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/pub-4343851330510276?href=https%3A%2F%2Fwww.getpaint.net&ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202505150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4343851330510276&plah=www.getpaint.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f25b842633f6e03c845782b612b1a3c9166ea3859b9dbdb3dc61dcb5f6b9037a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WlXEOBYrTg-j0IEDl52M1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:35 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw0ZBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDetfEW62EgbtK-zdoFxGZ-t1ntgFiIh-P8vh0H2QQW_N28kFlJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDI1MDUyEDPwCC-wAAAGW9DhA"
content-security-policy: script-src 'report-sample' 'nonce-WlXEOBYrTg-j0IEDl52M1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20250520/r20190131/ Frame 565E 8 KB
4 KB 51ms
17ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20250520/r20190131/zrt_lookup_fy2021.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

adb20dfcb3586b802e692ef1365bac860fd8670b85a67f0286677ac4268b6bd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.getpaint.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 5272
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 3856
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 17:17:44 GMT
etag: 7658452531946828944
expires: Wed, 04 Jun 2025 17:17:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxUh65lzdlmGF34ItpfXePtdT9P0lUAIIGgpMjEbmzz38SfI9e55b3nG7dkBdg2SsRM7b4XlMAP3XIxGMeyuz14V9DAQCxekMopHi8mR6B-Zg8InIxtqH3BGO9AS0e2EkfW1KHIuEw== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 51ms
50ms Script
application/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUh65lzdlmGF34ItpfXePtdT9P0lUAIIGgpMjEbmzz38SfI9e55b3nG7dkBdg2SsRM7b4XlMAP3XIxGMeyuz14V9DAQCxekMopHi8mR6B-Zg8InIxtqH3BGO9AS0e2EkfW1KHIuEw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3ODUzMTM1LDk3OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cuZ2V0cGFpbnQubmV0LyIsbnVsbCxbWzgsIm9hSzdhRm9fZi1VIl0sWzksImRlIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsIiJdLFsyOSwiZmFsc2UiXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.oaK7aFo_f-U.es5.O/d=1/rs=AJlcJMzhxMm9Y3CxHu-7B4vSUzyvVs8N2w/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f4ba7aa30e60bb2f3369ca89c67e259b78f2217b33d86f0592949aca3b059763

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-AjjFsXW-fJw3S9bgVZ4uOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjqtDikmJw15BiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIP1XdYBWpvsGaxH6TtQSIQx1vssaCcNpN1lQgXrPxFutWIG7Svs3aBcRmfrdZ7YBYiJvjwr4dB9kENixfzKWkkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkamBqZKBnYBBfYAAA-NxHgw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-AjjFsXW-fJw3S9bgVZ4uOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3918 105 KB
40 KB 682ms
677ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=280&adk=3788282855&adf=3717182569&w=336&lmt=1747702613&channel=1615128010&ad_type=text_image&format=336x280_as&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=124&bdt=319&idt=95&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&correlator=6553910538074&frm=20&pv=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=428&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=467

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e89bcf6f05af175794448cc77c9f23ed5f79b7678ce88482b05f6b9cebb93fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.getpaint.net/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41191
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:36 GMT
expires: Wed, 21 May 2025 18:45:36 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F3E0 850 B
430 B 508ms
507ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=250&adk=2767849875&adf=3946381816&w=250&lmt=1747702613&channel=2834294182&ad_type=text_image&format=250x250_as&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=119&bdt=319&idt=150&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=913&ady=286&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=473

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

bb00c75412d0418040c6c941e7798008bc906d2624a929cd9b19ede56db89f83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.getpaint.net/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 406
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:36 GMT
expires: Wed, 21 May 2025 18:45:36 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6E7A 25 KB
11 KB 495ms
492ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

428327687feab0450cbd7714c88da700e2d525e6b0bf4b42f49f9da6d7bd9a72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.getpaint.net/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11564
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:36 GMT
expires: Wed, 21 May 2025 18:45:36 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E57B 15 KB
5 KB 758ms
756ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&adk=1812271804&adf=3025194257&abgtt=8&lmt=1747702613&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=404x1080_l%7C404x1080_r&channel=1615128010&format=0x0&url=https%3A%2F%2Fwww.getpaint.net%2F&pra=7&wgl=1&aihb=0&asro=0&aifxl=29_18~30_19&aiapm=0.15&aiapmi=0.16&aiact=0.7&aicct=0.7&ailct=0.6348085447928734&aimart=8&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=2&bdt=319&idt=154&shv=r20250520&mjsv=m202505150101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as%2C728x90_as&nras=1&correlator=6553910538074&pv_ch=1615128010%2B&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fsapi=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&fsb=1&dtd=489

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

a6d60b6f238de907193114d6f5be305e98be41ac8415a5fad56101f5f4bd55a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.getpaint.net/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 5472
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:36 GMT
expires: Wed, 21 May 2025 18:45:36 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 AGSKWxUSNN2p3IpyHyCi7IEha1o2M83vXBbH7TVEnlNaG-K-lsHhwwCpxoHv5ugxBq_K3Ld-1UkAaHbifMnguyJMJvfZvs04wesR7SAURCYnsrPmfx5_xEi_QjZsmkr7_k2pg_L4YZkKDw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
1 KB 50ms
50ms Script
application/javascript 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUSNN2p3IpyHyCi7IEha1o2M83vXBbH7TVEnlNaG-K-lsHhwwCpxoHv5ugxBq_K3Ld-1UkAaHbifMnguyJMJvfZvs04wesR7SAURCYnsrPmfx5_xEi_QjZsmkr7_k2pg_L4YZkKDw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3ODUzMTM2LDE0ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vd3d3LmdldHBhaW50Lm5ldC8iLG51bGwsW1s4LCJvYUs3YUZvX2YtVSJdLFs5LCJkZSJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

5db21ddd8963f75c179a0c265491b962170d1d0978795bbde5cc34ec2cc95a17

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-7j-6xO_j2WW6J86BUmGJrA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjqtDikmJw15BiOHHrNtMFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIP1XdYBWpvsGaxH6TtQSIQx1vssaCcNpN1lQgXrPxFutWIG7Svs3aBcRmfrdZ7YBYiJvjwr4dB9kEDvxYEKekkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkamBqZKBnYBBfYAAAFlZIMw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-7j-6xO_j2WW6J86BUmGJrA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxU9pnDWGilF-fW2bVumxSWV6yMFD_lZe66aYtJWNSSZ07x-AGEAEXeecXfe0SAyPBVF09dqPK3xNPPYA9HChgo0FeJouDQdWveKIztVjx57pgtCsNr-MnSrWOrKp6E7sqdK2OWcRw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 66ms
36ms XHR
text/html 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU9pnDWGilF-fW2bVumxSWV6yMFD_lZe66aYtJWNSSZ07x-AGEAEXeecXfe0SAyPBVF09dqPK3xNPPYA9HChgo0FeJouDQdWveKIztVjx57pgtCsNr-MnSrWOrKp6E7sqdK2OWcRw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Nq5bggS4oMy-s1br-5saYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.getpaint.net/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:36 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0JBi-FB_mfUHEJv53Wa1A2IhHo4L-3YcZBNouHWtgVHJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRqYGhnoGZjGFxgAAJUBJ2g"
content-security-policy: script-src 'report-sample' 'nonce-Nq5bggS4oMy-s1br-5saYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.getpaint.net
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E7A 42 B
63 B 100ms
74ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BBOS0a8Q0O9HGsN3Bt3pNfNI6nLp-En4-zi7hWcH80tjclTx-mNq9Iz_w0SefqzCdB6HtVWIAAztV4ini9H8uel6YaytXZKhEwYrJpyaeNoRNm_lo

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6E7A 110 KB
37 KB 69ms
43ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

6355a7bcb2412bbb25a722e48636b58b050a7a4af7a68258919f7306e85de618

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 17872117406929459988
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 18:45:36 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38120
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/ Frame 6E7A 3 KB
1 KB 81ms
24ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 6078
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:04:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:04:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/ Frame 6E7A 19 KB
8 KB 79ms
21ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00cb7954e81964a084d2b6be31d34dec7e5bc75ce1e5eba690b3cc0b0640b5a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 9135495209924228279
age: 6078
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:04:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:04:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8097
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 6E7A 221 KB
68 KB 50ms
25ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

65871d0ac7a4d2399b5e6ee462cd1e5906e76b76e030ff4eff1829d2818f817c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 12838377887511038173
age: 2274
x-content-type-options: nosniff
expires: Wed, 21 May 2025 19:07:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 18:07:42 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69703
x-xss-protection: 0
server: cafe

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C976 499 B
207 B 37ms
36ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX9IwtQ4LwFUzqs0n_xSoEQgLmYGdMMH-KVjHbt5vHHTNUG0-JECqgfXjbGUJPskM6qDaeQc_4mnUscg1D4bgrbYnafZSNPMg281P-ioSs27tpow_I

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

5ee2a16d4f8f9629ae75e0f94473f8601a4e0bf9527ba4467a094926e0947505

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 183
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:36 GMT
expires: Wed, 21 May 2025 18:45:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame C976 170 B
409 B 95ms
24ms Image
image/png 172.217.16.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX9IwtQ4LwFUzqs0n_xSoEQgLmYGdMMH-KVjHbt5vHHTNUG0-JECqgfXjbGUJPskM6qDaeQc_4mnUscg1D4bgrbYnafZSNPMg281P-ioSs27tpow_I

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C976
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0&C=1

43 B
803 B

179ms
179ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX9IwtQ4LwFUzqs0n_xSoEQgLmYGdMMH-KVjHbt5vHHTNUG0-JECqgfXjbGUJPskM6qDaeQc_4mnUscg1D4bgrbYnafZSNPMg281P-ioSs27tpow_I
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OtaBgGg3Y4u%2Feq1mwb8FF69d5fMvg4ugNV%2Fbn3HguATJYDJ7v2dkvJzHuc1rvLfk4QhcVBXIdA0e7whaxY3rDy%2BGcXQlt2xhOrvgoMgXWLHeIeu1rLzIRWODerdl3fx8%2FHvvvGAjxb%2Bqvg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 21 May 2025 18:45:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 94363b593d9a5671-AMS
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6xVxa1gJoi1bOu9o5CJnVIbPlwGxnyovdAPS4hYm7u2NVgl%2FpjltFWI1Ec0ptTjTao9vdjK16MWNr7egxxBI0Yg2IU0egJMP6VUVRhCGTKJ2WFzqU1R9GgTl%2BFyppw%2FSJfPuInGachIEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 94363b587fc5d0d9-AMS
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 21 May 2025 18:45:36 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C976
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgdpr%3D0%26google_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=casale_media2_dsp_secure&google_cm&google_hm=aC4fULmqPU8AIq54AhPFWgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0

43 B
765 B

158ms
158ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX9IwtQ4LwFUzqs0n_xSoEQgLmYGdMMH-KVjHbt5vHHTNUG0-JECqgfXjbGUJPskM6qDaeQc_4mnUscg1D4bgrbYnafZSNPMg281P-ioSs27tpow_I
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2cwFDlZiULnqgC5oi0c72OgnvsPIimVXFScYCEHrzZVuGp0GaKqZkcZdqoPIsE24JYOgKFUdBlO2ypZ9qOh42%2FZJ%2B9GUfLYBtvdMBWBwyKyF0S2jpH3tzKtji%2F2CLd2vqRLoxGolKqYmDw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 21 May 2025 18:45:36 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 94363b596e2e5671-AMS
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEboqB4fUZiSC1Az8FxL-vg&google_cver=1&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 324
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E7A 0
20 B 49ms
49ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9794789855968&version=m202505060201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E7A 0
20 B 48ms
48ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9794789855968&version=m202505060201&ct=77&x=1&cor=31367525328712572

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6E7A 35 KB
20 KB 71ms
71ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DVrDjG0JgL9gOUcg1pXi3D5Mkz4HzYTC-GoZY0eUePIgM3hhanHb9bgWvGC4lBb5K2XWknRzwFKTFCGew2hhdSDz1KyNi9j-71qIeH-c6qZhWh2H3jkpROTF_dihyjwoV3CJ1kCPPeWRxYGx9pepzRu6WFVAzAlF23Q6-IeawLqitEPVSxCZm1Y52K3anmy9I-3w_PLwNXqNNhU6H1xf9-UzkTinTt9fq0LFIovnIRPsP0LC6nEIAMaxVw-jpVqbs9yABTjD9G0Rz8nMjWZgzMeMRuoQ&cry=1&dbm_d=AKAmf-DS_w1dbCBTC44tA14xRuFDSS6jGiteglRNA8DDKOn0Y-rkqY4UTvnLshid73CN0VgB_krrizuigpttZ3lDdPxnz6pzyueRV_QGD_qRd9-vJttT_d6Bq5kFOszkm0dP13JPWf6k2HLXF8ZXsK-WC3zv8G3YMhophTce4RFCDIBimoyUy1pxCAEvt-PZ_tdQdGDyeC9NHJv3t7F90F_OKVzwZesJZ_2eYbymAiCZbpZhm2sotFCYpbX6RuIE7WKSo8Vkc42yp5cTLwRdgfVaWB8TMQ6Fmkok7a6ufiZLmXZ2-ZPBidjbZ9rA03BcBreP0Cp0tsGUl_m0X-MCIfYSRyiLpMPC8xXo8_sIe-ionWMjUzfR13ADjdJclID1bycWUq4hNa4bpTfOqCHLZ8du10hhzty380fJX7OwHZgDArghFkILP5tJ4jdvvg-7cijzdkZk0RN2_JuOPvy_8lFSUaetI-nAxkM-3BsGDkkCwrVtVry4HDvP1ek38kQ1w8uDmrhqVUrr5TQCqX7AQkb7b_36lE6gcp7HLhnHKo9S10xZ4bFrV9POnwtGc7jk0JIgLwyZcxkpCktGEovjUEmxd1mK2RMM6tj3VaVzOk1t_yidycRXhwLMqvH73Mb6-Afx326GYuCK4U6Xyy8tt1xbjyotZFPXlgHwDjfP6p2lDpXfluUs53bqdxJLRPjMv_67qpe0FwV6RVlFEtxwhamHvFW87iL1LLnlfmC_wm3nP6mwjLGN-WdfiIrGpyBwTBioAx-t4gFfeT0r-a3xGv93hVpXpppe3XkHy298-ESH1wJSvfqonYnOkz414iAtGl7697n3whRLYtL2LOoFa0qfM7kjOkTNZSskStsN1I4R1EY2c32bShkZ_2kEWhF2MjKl_0THj_8bYAVuX2MVxduFIHNcRCcwcx6DDM0WxFO-ZyyYMlM0MhI4S5A6UF_4oHCX1Cr08oINoS1c_GrrK18cASIbqAp1CtvP3qQVdwdPFJQOv9aA95uxRuRjlk4WdzQHP4UzI1Jb1dCGEyPV_sYBEE2FJwYT384tTbkeMsz0sd4PjXUnWLsoD1AozacF96gvkdB62uXggsLcKpi7QoWBOsmC2iSN3YT00Umb-6aWkTSIOpgkA66SPA4yRY7INHURPgmMge9kUgPQ6bgXDH1rgjGFRUd42NOk5ySekhoKalE79MKOk6ysoGNLTxCkfZqu3O4Q_gVMOU6fcDVusVKKRE1E3poNku8kxaWS-4Hl5V1wP6tnGrWYSWl2s6ERanBrUXGSEb0XgK7myAHQOt2z1bAzPmhWewbRdH8pRwwuy70rYpTs9GGCMGankzpS9oCObi40tL47RodxwIgdpdBRUmQzkG9gBokgnWWIb0oN019WYMshZStuvJdBpZBesASyFrLktEk05X-XMp5SqVxXJXtQqqGFSF-kVw0fI3IYcNo4Tt0tfVUGu3TXtfkttqfC-stN-VmzMz_JTVH-ekgZIjYuk8gLawwr5-JWLhZ55BTSVMFjbigMiPyznI3aiNdhvmdzjfgvKsWzUOQZ99K-kdxgB1zdXR7X-X0x3r7sYvc6Nur5O_xWfjF9BszBQh93Xz9-3yZjSAI9NPzIiZa5Ay0mB1bIjP9Y2ssp_sxo7eJ8SCRcK5i8Jh3wnXcjCp0bNLESFs2ssgo3TZA0GzK0W7zMCPvRlpxWrjNICcC78T7Se5enBwsu82CJ4y2JzzZ1CRnskRDwXyJKCmfeq1XE0UVmScrD8jPQ7MPPftBzwRciZq924sUld1SVbuvYVafv2a6P3LnIFh1Y71rRw3ey8TeqFDS9cKo7KM-7O0TrzAmimQvkp_oZFkFlDPGAT0pSr4Vz0sC__E3MY2SC2DBkLXcKC07cAUVoZ5x4_CfiWOCkZ4ZsNpB8iZejiZ8OnXPsDSMKj0Z_xhClGx5vn1q4LONvEGlCC4RKSmd3ITQh9SME2rjDY4TRI-bRyhSHIyUHCp_4MpJniAa9Mh2qs4VXHRsFRJrEAb9B8NgaBZ2URmoFWc3_ABXXgfaFDHpBOHcZR1RNnQiur0D45UYjvUGqNqbZXkr4wmaqrF0izd4RRirYFl3qCpPeclzOBlYdLJn4hDv4mIobBVaHXtT2O1Hy1_2EHWtfysfTgrBm2qE7iW-ml6cgv3XZ_lzvNN-lDYXiGULudPqdTWSIDnPBZ2p_dqgTvUXxmfB2tm9U6M0yA6YxNlHeWU2YnLFSbtXf2BrDCE_lSvga4IA_Em0XAsOe6k3s94RsyBAu2GwtgHur_H4sse_c0mVlixBis1Jp6hssDnQCDhJXjc7HxmeEznhhfuasrOjogv9K8BZl-xUmuyXOXNeTIsId2D-MVaETxZkVIvhJfoEXupkJyfFt7025ne1nSygeFRb9u_Qa_yOAumm9K9vqpiiKL5use6BJMBeuRZ3M7QiAGv3GdyeZLSSFWGcL1XBYvGhA2mZsUTr6EOfL1UVsOHwZBGsRpz3IKLNToV4QNcFziEqh6x2YDB8u_WXkh7po4lMX9D5okl9ZOe9dgxXgW3MbhTyZoC-ntO-_8BZaZ_41xl4HNNsUGb5Is_407ZgB8SGMuS27F_A2CkQ-kXNCaqXNs1_5RaQniy96PhVdiCcl-0JbmS_5zt_4pG3afRCwqP_GJGsukBb20w8XftaCBIuVS12pgdFAF0jyLd2h8S-FoRqXSZuEt7vlhRcgmVL2ZSWWn8zFZMHXZkYvSkl_awtvkxwRVX-xp76SYqsWWZGm2p85YkvLHXPMcDjKWhmkdbhjPgR12lanKrN2cWtRnctLS0qCVmtQQNlx2A-C52yyKwDwJgkHI0b0kC6BHGFn2fWex5BfXy6FLHkucfYPwUhKXnrV7cd-QCKBNmhz4z0_dK7FMwLd_Xlr0TcoN7MNy7MZWDAB6xMRYaFPQzoka-pUhwFecQ50AWd9KoIbPDPmCbxkzrkE3xad0YUxp6RKzPMBztrNK-_H7Ck6siGPtpKvCCL5VuUZ_84zYFoQcZiDEuXy-aumkgGw6JhMgzbCKkQNCTxyjsez8JGuK6ByegqOXI_Tl9xONZUWgO-THaP5ZsDLozUth5NzLmXe6l94ZUHzicRYKfVNX-_GuDoW9asBJa30xHCEUXTJA6Gz0mk2mNr7GitQgivokQJSbcKPcDCOfIQlaEwZzDs_XFZPCi0I8luAGH93tgDh0OM6mFzX3blt1_5W1ZV8NyZqpdPnpocqzbPISFvIa1w_hv5VSwDWVOs9YlQzJ7f-qY6fYtMQkXx9XIgWBlH07EyF5RLbqY1_Rmn0GXZ3jsxaBLuh8-tWbf4kzEghJSvh0uXH_hG4FDtC_5EiERj1OvQm_f9ZURuGGIN8esrF9zcxsTxsdfF1HYmbCaeSgImv_Zw0w2vq5Gbun3lWdG6wDhN6kgkr97OUoYoE-tEvVdhf-9VHtDfqAp9IG7HhK9Q4OeieN_pGuQSKKOGQx05gI8emz5q9TUv5iIFSM2D2fqDKBMadlztBqZnLA0b0tqiskw7YXpxzVBzmLkzF897nynklxIeMMRGNLs3_O2nQSAaNQn5O1QbIUiJO09wGj4N4zRJYystacsrZ2AUlAbxNbQHkXXgiKsHPWzCa0lC3HSBtKVHVZlt1PyV4FTdBoiSZAhgaGmt4rzZsq_zeT351pXp_nhkFByECGWV7VxylbgqNMiBEboSfACPAd6XTSEbAV2KvSFfMkOSfVaMJRkkFBbU0oFO3i9I__DMlOvqZG05H3luc-e2RbWpIAeU7zKC_g1NBpJvNhjnGuzrLpBV_MtBt6OnKqqHpm-LLyhh13Tx9LDIRkS-m47elyrqhmS9VYS9CowB91QRXO4-BYt8PxKmNnu_KOxN9Wi-gXQCBzkIhinyyxFER1hEIsiQi7x8_Cnhm-_JQrgP1t2MwNp0R1RxKRuUkLYUFS9-ytFTZfZ5wLjOlKjw9gPdt31iH0TgaQ958wjN9mEeCikC3MSr7NiI-XrGtjXoGWaFETkH-2gyK8iRdbwYJPpaJqFNN5qTJq7h6QfclkwgCACPjC0G-3tcy7clXFc-J0cCnDe0jS-sFW7CF6NAjgdpiFcGFGVwTpzd-x_E3y_0j1fcnKrh_xRBnxehGLaDw-LpXvFdxknGTpthWVl_4vtWu0KNFROhLqytaqI6jEwZb0CgyfpvIt5kIcFgZdn-3zCPyoAcfQw5ycTj_CFZL6vkJeb7Ok-JhSDJx7ydCyCaOqit-oYZ4mcqCLC6ZYA&cid=CAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB&dv3_ver=m202505060201&nel=1&rfl=https%3A%2F%2Fwww.getpaint.net%2F&ds=l&xdt=1&ct=77&iif=1&cor=31367525328712572&adk=2857193499&idt=87&cac=0&dtd=57

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef83bcc760b0ec83296183735ed7661b5adf5349837fbd77701fa8e3a13d1373

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 20419
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 2798698337033777244
tpc.googlesyndication.com/simgad/ Frame 3918 84 KB
84 KB 44ms
42ms Image
image/gif 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2798698337033777244

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=280&adk=3788282855&adf=3717182569&w=336&lmt=1747702613&channel=1615128010&ad_type=text_image&format=336x280_as&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=124&bdt=319&idt=95&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&correlator=6553910538074&frm=20&pv=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=428&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=467

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b3fc84026e583925171b9ab0deb0d723797d40d17dc7d93b9410fdb8b6316d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

age: 125509
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Wed, 20 May 2026 07:53:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Tue, 20 May 2025 07:53:47 GMT
last-modified: Thu, 15 May 2025 11:44:49 GMT
content-type: image/gif
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 85829
x-xss-protection: 0
server: sffe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/ Frame 3918 22 KB
9 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aafb777c59d54093f12d271484c6ed79b3c4b85703df5ac5c567993f0509c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 8838669320932718355
age: 6078
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:04:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:04:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8654
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/ Frame 3918 3 KB
0 2ms
1ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 6078
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:04:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:04:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/ Frame 3918 19 KB
0 0ms
0ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00cb7954e81964a084d2b6be31d34dec7e5bc75ce1e5eba690b3cc0b0640b5a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 9135495209924228279
age: 6078
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:04:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:04:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8097
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 3918 221 KB
0 1ms
0ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

65871d0ac7a4d2399b5e6ee462cd1e5906e76b76e030ff4eff1829d2818f817c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 12838377887511038173
age: 2274
x-content-type-options: nosniff
expires: Wed, 21 May 2025 19:07:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 18:07:42 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69703
x-xss-protection: 0
server: cafe

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/ Frame 3918 36 KB
15 KB 91ms
88ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3ccb071d95a4f71f35523f1bcf349892a0f88dbb6ffc46df5ab2b6988640043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 10931729761902472102
age: 6016
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:05:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:05:20 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 14788
x-xss-protection: 0
server: cafe

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 3918
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CgKO1UB8uaPC1A_TUiM0Prc_PYOaRooR_6ee3qKgU29keEAEgtuHZBGCVgoCAsAegAZyv-6gCyAEDqAMByAPJBKoEygFP0EweI8uzo_T20Zwib5VYEzaJ4pPmC1pPgmtPg5R7EByr87NdK2X...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228615651770236381502%22,%22debug_reporting%22:true,%22destination%22:%22https://hero-wars.com%22,%22event_report_window%22:...

0
0

171ms
66ms

Fetch
text/css

172.217.18.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228615651770236381502%22,%22debug_reporting%22:true,%22destination%22:%22https://hero-wars.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22622778268%22],%2222%22:[%22true%22],%224%22:[%2205-21%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224621936173959417937%22}&andc=true

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: private
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:36 GMT
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
attribution-reporting-register-source: {"debug_key":"8615651770236381502","debug_reporting":true,"destination":"https://hero-wars.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["622778268"],"22":["true"],"4":["05-21"],"6":["true"]},"priority":"500","source_event_id":"4621936173959417937"}
content-type: text/css; charset=UTF-8
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"8615651770236381502","debug_reporting":true,"destination":"https://hero-wars.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["622778268"],"22":["true"],"4":["05-21"],"6":["true"]},"priority":"500","source_event_id":"4621936173959417937"}&andc=true
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A6FE 143 B
166 B 22ms
22ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=280&adk=3788282855&adf=3717182569&w=336&lmt=1747702613&channel=1615128010&ad_type=text_image&format=336x280_as&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=124&bdt=319&idt=95&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&correlator=6553910538074&frm=20&pv=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=428&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=467
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 462
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:37:54 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3918 0
0 98ms
96ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3918 0
0 88ms
88ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 3918 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 782e92e85a169f757aa4c30c07e286e5a92e8e8214b1f36f8f2c30cc587b4864

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250520/r20110914/ Frame 6E7A 29 KB
11 KB 28ms
28ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250520/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DVrDjG0JgL9gOUcg1pXi3D5Mkz4HzYTC-GoZY0eUePIgM3hhanHb9bgWvGC4lBb5K2XWknRzwFKTFCGew2hhdSDz1KyNi9j-71qIeH-c6qZhWh2H3jkpROTF_dihyjwoV3CJ1kCPPeWRxYGx9pepzRu6WFVAzAlF23Q6-IeawLqitEPVSxCZm1Y52K3anmy9I-3w_PLwNXqNNhU6H1xf9-UzkTinTt9fq0LFIovnIRPsP0LC6nEIAMaxVw-jpVqbs9yABTjD9G0Rz8nMjWZgzMeMRuoQ&cry=1&dbm_d=AKAmf-DS_w1dbCBTC44tA14xRuFDSS6jGiteglRNA8DDKOn0Y-rkqY4UTvnLshid73CN0VgB_krrizuigpttZ3lDdPxnz6pzyueRV_QGD_qRd9-vJttT_d6Bq5kFOszkm0dP13JPWf6k2HLXF8ZXsK-WC3zv8G3YMhophTce4RFCDIBimoyUy1pxCAEvt-PZ_tdQdGDyeC9NHJv3t7F90F_OKVzwZesJZ_2eYbymAiCZbpZhm2sotFCYpbX6RuIE7WKSo8Vkc42yp5cTLwRdgfVaWB8TMQ6Fmkok7a6ufiZLmXZ2-ZPBidjbZ9rA03BcBreP0Cp0tsGUl_m0X-MCIfYSRyiLpMPC8xXo8_sIe-ionWMjUzfR13ADjdJclID1bycWUq4hNa4bpTfOqCHLZ8du10hhzty380fJX7OwHZgDArghFkILP5tJ4jdvvg-7cijzdkZk0RN2_JuOPvy_8lFSUaetI-nAxkM-3BsGDkkCwrVtVry4HDvP1ek38kQ1w8uDmrhqVUrr5TQCqX7AQkb7b_36lE6gcp7HLhnHKo9S10xZ4bFrV9POnwtGc7jk0JIgLwyZcxkpCktGEovjUEmxd1mK2RMM6tj3VaVzOk1t_yidycRXhwLMqvH73Mb6-Afx326GYuCK4U6Xyy8tt1xbjyotZFPXlgHwDjfP6p2lDpXfluUs53bqdxJLRPjMv_67qpe0FwV6RVlFEtxwhamHvFW87iL1LLnlfmC_wm3nP6mwjLGN-WdfiIrGpyBwTBioAx-t4gFfeT0r-a3xGv93hVpXpppe3XkHy298-ESH1wJSvfqonYnOkz414iAtGl7697n3whRLYtL2LOoFa0qfM7kjOkTNZSskStsN1I4R1EY2c32bShkZ_2kEWhF2MjKl_0THj_8bYAVuX2MVxduFIHNcRCcwcx6DDM0WxFO-ZyyYMlM0MhI4S5A6UF_4oHCX1Cr08oINoS1c_GrrK18cASIbqAp1CtvP3qQVdwdPFJQOv9aA95uxRuRjlk4WdzQHP4UzI1Jb1dCGEyPV_sYBEE2FJwYT384tTbkeMsz0sd4PjXUnWLsoD1AozacF96gvkdB62uXggsLcKpi7QoWBOsmC2iSN3YT00Umb-6aWkTSIOpgkA66SPA4yRY7INHURPgmMge9kUgPQ6bgXDH1rgjGFRUd42NOk5ySekhoKalE79MKOk6ysoGNLTxCkfZqu3O4Q_gVMOU6fcDVusVKKRE1E3poNku8kxaWS-4Hl5V1wP6tnGrWYSWl2s6ERanBrUXGSEb0XgK7myAHQOt2z1bAzPmhWewbRdH8pRwwuy70rYpTs9GGCMGankzpS9oCObi40tL47RodxwIgdpdBRUmQzkG9gBokgnWWIb0oN019WYMshZStuvJdBpZBesASyFrLktEk05X-XMp5SqVxXJXtQqqGFSF-kVw0fI3IYcNo4Tt0tfVUGu3TXtfkttqfC-stN-VmzMz_JTVH-ekgZIjYuk8gLawwr5-JWLhZ55BTSVMFjbigMiPyznI3aiNdhvmdzjfgvKsWzUOQZ99K-kdxgB1zdXR7X-X0x3r7sYvc6Nur5O_xWfjF9BszBQh93Xz9-3yZjSAI9NPzIiZa5Ay0mB1bIjP9Y2ssp_sxo7eJ8SCRcK5i8Jh3wnXcjCp0bNLESFs2ssgo3TZA0GzK0W7zMCPvRlpxWrjNICcC78T7Se5enBwsu82CJ4y2JzzZ1CRnskRDwXyJKCmfeq1XE0UVmScrD8jPQ7MPPftBzwRciZq924sUld1SVbuvYVafv2a6P3LnIFh1Y71rRw3ey8TeqFDS9cKo7KM-7O0TrzAmimQvkp_oZFkFlDPGAT0pSr4Vz0sC__E3MY2SC2DBkLXcKC07cAUVoZ5x4_CfiWOCkZ4ZsNpB8iZejiZ8OnXPsDSMKj0Z_xhClGx5vn1q4LONvEGlCC4RKSmd3ITQh9SME2rjDY4TRI-bRyhSHIyUHCp_4MpJniAa9Mh2qs4VXHRsFRJrEAb9B8NgaBZ2URmoFWc3_ABXXgfaFDHpBOHcZR1RNnQiur0D45UYjvUGqNqbZXkr4wmaqrF0izd4RRirYFl3qCpPeclzOBlYdLJn4hDv4mIobBVaHXtT2O1Hy1_2EHWtfysfTgrBm2qE7iW-ml6cgv3XZ_lzvNN-lDYXiGULudPqdTWSIDnPBZ2p_dqgTvUXxmfB2tm9U6M0yA6YxNlHeWU2YnLFSbtXf2BrDCE_lSvga4IA_Em0XAsOe6k3s94RsyBAu2GwtgHur_H4sse_c0mVlixBis1Jp6hssDnQCDhJXjc7HxmeEznhhfuasrOjogv9K8BZl-xUmuyXOXNeTIsId2D-MVaETxZkVIvhJfoEXupkJyfFt7025ne1nSygeFRb9u_Qa_yOAumm9K9vqpiiKL5use6BJMBeuRZ3M7QiAGv3GdyeZLSSFWGcL1XBYvGhA2mZsUTr6EOfL1UVsOHwZBGsRpz3IKLNToV4QNcFziEqh6x2YDB8u_WXkh7po4lMX9D5okl9ZOe9dgxXgW3MbhTyZoC-ntO-_8BZaZ_41xl4HNNsUGb5Is_407ZgB8SGMuS27F_A2CkQ-kXNCaqXNs1_5RaQniy96PhVdiCcl-0JbmS_5zt_4pG3afRCwqP_GJGsukBb20w8XftaCBIuVS12pgdFAF0jyLd2h8S-FoRqXSZuEt7vlhRcgmVL2ZSWWn8zFZMHXZkYvSkl_awtvkxwRVX-xp76SYqsWWZGm2p85YkvLHXPMcDjKWhmkdbhjPgR12lanKrN2cWtRnctLS0qCVmtQQNlx2A-C52yyKwDwJgkHI0b0kC6BHGFn2fWex5BfXy6FLHkucfYPwUhKXnrV7cd-QCKBNmhz4z0_dK7FMwLd_Xlr0TcoN7MNy7MZWDAB6xMRYaFPQzoka-pUhwFecQ50AWd9KoIbPDPmCbxkzrkE3xad0YUxp6RKzPMBztrNK-_H7Ck6siGPtpKvCCL5VuUZ_84zYFoQcZiDEuXy-aumkgGw6JhMgzbCKkQNCTxyjsez8JGuK6ByegqOXI_Tl9xONZUWgO-THaP5ZsDLozUth5NzLmXe6l94ZUHzicRYKfVNX-_GuDoW9asBJa30xHCEUXTJA6Gz0mk2mNr7GitQgivokQJSbcKPcDCOfIQlaEwZzDs_XFZPCi0I8luAGH93tgDh0OM6mFzX3blt1_5W1ZV8NyZqpdPnpocqzbPISFvIa1w_hv5VSwDWVOs9YlQzJ7f-qY6fYtMQkXx9XIgWBlH07EyF5RLbqY1_Rmn0GXZ3jsxaBLuh8-tWbf4kzEghJSvh0uXH_hG4FDtC_5EiERj1OvQm_f9ZURuGGIN8esrF9zcxsTxsdfF1HYmbCaeSgImv_Zw0w2vq5Gbun3lWdG6wDhN6kgkr97OUoYoE-tEvVdhf-9VHtDfqAp9IG7HhK9Q4OeieN_pGuQSKKOGQx05gI8emz5q9TUv5iIFSM2D2fqDKBMadlztBqZnLA0b0tqiskw7YXpxzVBzmLkzF897nynklxIeMMRGNLs3_O2nQSAaNQn5O1QbIUiJO09wGj4N4zRJYystacsrZ2AUlAbxNbQHkXXgiKsHPWzCa0lC3HSBtKVHVZlt1PyV4FTdBoiSZAhgaGmt4rzZsq_zeT351pXp_nhkFByECGWV7VxylbgqNMiBEboSfACPAd6XTSEbAV2KvSFfMkOSfVaMJRkkFBbU0oFO3i9I__DMlOvqZG05H3luc-e2RbWpIAeU7zKC_g1NBpJvNhjnGuzrLpBV_MtBt6OnKqqHpm-LLyhh13Tx9LDIRkS-m47elyrqhmS9VYS9CowB91QRXO4-BYt8PxKmNnu_KOxN9Wi-gXQCBzkIhinyyxFER1hEIsiQi7x8_Cnhm-_JQrgP1t2MwNp0R1RxKRuUkLYUFS9-ytFTZfZ5wLjOlKjw9gPdt31iH0TgaQ958wjN9mEeCikC3MSr7NiI-XrGtjXoGWaFETkH-2gyK8iRdbwYJPpaJqFNN5qTJq7h6QfclkwgCACPjC0G-3tcy7clXFc-J0cCnDe0jS-sFW7CF6NAjgdpiFcGFGVwTpzd-x_E3y_0j1fcnKrh_xRBnxehGLaDw-LpXvFdxknGTpthWVl_4vtWu0KNFROhLqytaqI6jEwZb0CgyfpvIt5kIcFgZdn-3zCPyoAcfQw5ycTj_CFZL6vkJeb7Ok-JhSDJx7ydCyCaOqit-oYZ4mcqCLC6ZYA&cid=CAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB&dv3_ver=m202505060201&nel=1&rfl=https%3A%2F%2Fwww.getpaint.net%2F&ds=l&xdt=1&ct=77&iif=1&cor=31367525328712572&adk=2857193499&idt=87&cac=0&dtd=57

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

61dea330474d8c135794901180a689bb4790db7daa0d26b148256e1dee02cbaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 13047051977436148356
age: 6076
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:04:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:04:20 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10884
x-xss-protection: 0
server: cafe

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6E7A 41 KB
14 KB 27ms
26ms Script
text/javascript 172.217.18.1
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
age: 1834
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Wed, 21 May 2025 19:05:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:15:02 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0Nzg1MzEzNjczNTU2OAogIHNlcnZlcl9pcDogNDAyMTYwCiAgcHJvY2Vzc19pZDogMTI5MzQ3ODk3Nwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0Mwph...
ad.doubleclick.net/ddm/activity/ Frame 6E7A 0
23 B 114ms
65ms Image
image/png 142.250.186.70
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0Nzg1MzEzNjczNTU2OAogIHNlcnZlcl9pcDogNDAyMTYwCiAgcHJvY2Vzc19pZDogMTI5MzQ3ODk3Nwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNDAwNTYyODAyMTk4NDI3NzIzNQpkZWJ1Z19rZXk6IDEzNTQ5NTgyMDE1MjI3NzUxNTUzCmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyNS0wNS0yMSIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIkRFIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NDg0MAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT09LSUVfQ09OU0VOVAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA4NjM4CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3ODA0NzYwODgzMgpkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3CnhmYV9hdHRyaWJ1dGlvbl9hcGlfdHlwZTogWEZBX0FUVFJJQlVUSU9OX0FQSV9UWVBFX1dFQgplY2hvX3NlcnZlcl9hY3Rpb246IEVDSE9fU0VSVkVSX0FDVElPTl9VU0VfQkVTVF9BVkFJTEFCTEVfQVJBCmV2ZW50X3JlcG9ydGluZ193aW5kb3dzIHsKICBlbmRfdGltZXNfc2Vjb25kczogODY0MDAKICBlbmRfdGltZXNfc2Vjb25kczogMzQ1NjAwCn0KbWF4X2V2ZW50X2xldmVsX3JlcG9ydHM6IDIK

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x159575446e5a18c90000000000000000","13":"0x8b136884a589ac570000000000000000","14":"0x392e77fe2b74c1440000000000000000","15":"0x9bc9c1d37f2233990000000000000000"},"debug_key":"13549582015227751553","debug_reporting":true,"destination":["https://redintelligence.net"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":[],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["11868943"]},"max_event_level_reports":2,"priority":"0","source_event_id":"14005628021984277235"}
content-type: image/png
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3918 0
0 62ms
62ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame 6E7A 12 KB
5 KB 84ms
24ms Script
text/html 88.99.219.174
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=0&gdpr_consent=&rnd=1747853136089940&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 Ahnsbeck, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 37d6e43a2137ce49b509abfb8505fa307d0d18c7e335045e737cce79466c4cb9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

Content-Encoding: gzip
Content-Length: 4430
Date: Wed, 21 May 2025 18:45:36 GMT
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Apache
Connection: close

GET
H3 200 view
googleads.g.doubleclick.net/btr/ Frame 3918 0
0 57ms
57ms Fetch
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/btr/view?ai=CgKO1UB8uaPC1A_TUiM0Prc_PYOaRooR_6ee3qKgU29keEAEgtuHZBGCVgoCAsAegAZyv-6gCyAEDqAMByAPJBKoEygFP0EweI8uzo_T20Zwib5VYEzaJ4pPmC1pPgmtPg5R7EByr87NdK2XrPv7SbkqbUBbL0PfdViUuVZzmwS8aX5Zpx7qbu-3O1PmX80dRVbrp4f9Wv-iz495xp0Ily8xhb3ra_fLJiND2STIphXERIYBdkD-47jqs9fFlHbf_zv7SoHSDFZ7FXIoZQ2LcG961kwVhaZlXNCYi2A8aj8U_GC5mFthLcn58UAHUsEXL2tdVCVcRL4jQSXU3ALvH2DdZ2JnM8ww_3XburduPwAS-iP6lgAWIBd_dx6pSkgUECAQYAZIFBAgFGASgBgOAB8zQhNcBqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwHyBwQQ4ulR0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpYpIOsqpy1jQOaCYkCaHR0cHM6Ly93d3cuaGVyby13YXJzLmNvbS8_ZGVsYXllZHNpZ251cD10cnVlJm54X3NvdXJjZT1hZHhfYWR3b3Jkc2Rpc3BsYXkuaHdfd2JfdWZfLS5jYy13d19kZV9lbi5nLW1peC5hLW1peC5hdS1sYWwub3B0LXB1cmNoYXNlMi5jci1od19zdF9sb290d29tZW45Yl9naWYuY24tMzAwXzI1MC5scC1kZWxheWVkLmR0LWRpc3BsYXkuY2lkLTIyMTAwOTYzMDM5LmFnaWQtMTcxODc4MzUxOTM0LmNzZC0xNTA1MjUuLSZhaWQtNzUyMjMyNjE3MTc4JmdhZF9zb3VyY2U9NYAKAcgLAeoNEwjN5dCqnLWNAxV0KqIDHa3nEwzYEw3QFQGYFgH4FgGAFwGyFyAKGggAEhRwdWItNDM0Mzg1MTMzMDUxMDI3NhgAGAEqALoXAjgBshgJEgKwUxgDIgEA0BgB6BgB&sigh=t3-f8WOQyKQ&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgDZpuyzsLNSNGb5V3mMtvj9QqkHqzpNk9FLn1PTjPCRIgxEEgtgNAtaateniOyqMoobQkPunCfJW5mW9FWXO3n_x_57ShebjIL_Jp3p1BgB&vis=1&ibtr=1&nis=6

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=280&adk=3788282855&adf=3717182569&w=336&lmt=1747702613&channel=1615128010&ad_type=text_image&format=336x280_as&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=124&bdt=319&idt=95&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&correlator=6553910538074&frm=20&pv=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=428&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=467

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 21 May 2025 18:45:36 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H2 200 css
fonts.googleapis.com/ 1 KB
550 B 120ms
52ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Symbols%3Aopsz%2Cwght%2CFILL%2CGRAD%4020..48%2C100..700%2C0..1%2C-50..200

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a0316f0fe3fd8c4927a2fcf78579d133ca4eea8f655865aa2ea4182bdaa400fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:36 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 21 May 2025 18:45:36 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ 20 KB
2 KB 183ms
115ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Text%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1049ad9ea0d1015b31c6e7bf258d692e9e2f3c16526a27bb4fb0718ca3f3ccbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:37 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 21 May 2025 17:29:50 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 656 B
464 B 120ms
53ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Google+Symbols:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7270a088b61596bb9627c37a26da5d97399dee1659443fda484e81609d723921

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:36 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 21 May 2025 18:45:36 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ 20 KB
3 KB 118ms
51ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google+Sans+Text:400,500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1049ad9ea0d1015b31c6e7bf258d692e9e2f3c16526a27bb4fb0718ca3f3ccbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:36 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 21 May 2025 17:23:21 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H/1.1

200
OK

request.php Show response
hal900011.redintelligence.net/ Frame 6E7A
Redirect Chain

https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

9 KB
3 KB

106ms
80ms

Script
application/x-javascript

138.201.64.38
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484
Protocol: HTTP/1.1
Server: 138.201.64.38 Mannheim, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c131924c3ce72c2cf8f6194f24533f63026d7926346faeee6f97066cf72360b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Content-Encoding: gzip
Pragma: no-cache
Connection: close
Expires: Wed, 21 May 2025 19:45:37 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 2306
Date: Wed, 21 May 2025 18:45:37 GMT
Content-Type: application/x-javascript; charset=utf-8
Vary: Accept-Encoding
Server: Apache
X-NEORY-SubId: 96568000171247804444550013062011

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Pragma: no-cache
Connection: close
Expires: Wed, 21 May 2025 19:45:37 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 0
Date: Wed, 21 May 2025 18:45:37 GMT
Content-Type: text/html; charset=UTF-8
Server: Apache

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 2E0B 38 KB
13 KB 20ms
19ms Document
text/html 172.217.18.1
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1835
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:15:02 GMT
expires: Wed, 21 May 2025 19:05:02 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A6FE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

23ms
22ms

Document
text/html

142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:37 GMT
expires: Wed, 21 May 2025 18:45:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:37 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 HVfYMg_tbqFPscqlZMGL1byfcR9ERNJ18Ev-pBY5zHk.js Show response
pagead2.googlesyndication.com/bg/ Frame CCE5 57 KB
22 KB 18ms
17ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HVfYMg_tbqFPscqlZMGL1byfcR9ERNJ18Ev-pBY5zHk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

1d57d8320fed6ea14fb1caa564c18bd5bc9f711f4444d275f04bfea41639cc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
age: 87871
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Wed, 20 May 2026 18:21:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 20 May 2025 18:21:06 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 22242
x-xss-protection: 0
server: sffe

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 73ms
48ms Fetch
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202505150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4343851330510276&plah=www.getpaint.net
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.getpaint.net/

Response headers

GET
H3 200 5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2
fonts.gstatic.com/s/googlesanstext/v23/ 22 KB
22 KB 47ms
17ms Font
font/woff2 142.250.184.195
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Text%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

sffe /

Resource Hash

c3f8c3da4430d08cda67d76bb22d139eb22bc7f85fb703e2121163dd2ffac787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.getpaint.net
Referer: https://fonts.googleapis.com/

Response headers

age: 125468
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 20 May 2026 07:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 20 May 2025 07:54:29 GMT
last-modified: Tue, 04 Feb 2025 19:57:02 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22056
x-xss-protection: 0
server: sffe

GET
H3 200 Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js Show response
pagead2.googlesyndication.com/bg/ Frame 2E0B 54 KB
21 KB 15ms
15ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

59bf1b3d98a046f73f1852acf5aaed1f0080124d087ebeafc7cfb15e5ab1d6ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 153879
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Wed, 20 May 2026 00:00:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 20 May 2025 00:00:58 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21184
x-xss-protection: 0
server: sffe

GET
H2 200 e99aace94e6e5873f6bc5749724bd084 Show response
pv.medialead.de/trck/epv/ Frame EBE0 208 B
582 B 109ms
28ms Document
application/javascript 91.121.248.44
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e5873f6bc5749724bd084?subid=96568000171247804444550013062011&gdpr=1&consent=1&gdpr_consent=CPOBKPOPOBKPrCnABCDEBwCsAP_AAAAAAAYgH4pd9D7dbXFDefx9Wvt0OYwW1tBXC-QCChSBA2AFQAGQ8LQAk0EaMATAhiACEQIAolIBAAEkHAFEAEAQQIAEAAHsAgSEhAAKIAJEGBERAAIQAAoKAAAAAAAIgABBqASAmAiQS9buRUAAuIgwRApIgAgBCIBHAoMBQAAIAAAIAAIAAACQ0A4AKwAXABDAD8AIKAWkBF4CRAE7AKRAYeAxgBnwDlBUA0AIYATAAuACOAH4ARwAtICQQExALzAYeAz4Byg6COAAsACoAGQAOQAfACAAFwAMgAaAA8AB9AEMARQAmABPACtAFwAXQAvgBiADMAG8AOYAfoBDAESAI4ASwAmABNACjAFKALEAW4AwwBlADRAHtAPsA_QCBgEWAI4ASkAsQBaYC5gLqAXkAxQBtADcAHEAOoAegBDYCLwEggJEATsAocBeYDBgGHgMSAYwAyQBlQDLAGfANOAawA4sBygDowHjgPxIQIAAFgAZABcAEMAJgAXAAvgBiADMAG8ARwAsQBlQD7APwAjgBKQChgFpALmAYoA2gB1AD0AJBASIAk4BbQDDwGJAM-AdGA8clAjAAQAAsADIAHAAPgA8ACIAEwALgAXwAxABmADbAIYAiQBHACjAFKALcAZQA1QB-AEcAJOAWkAuoBigDcAHUAReAkQBeYDDwGWAM-AawEgbAAIAAWABUADIAHIAPABAADIAGgAPIAhgCKAEwAJ4AVgA3gBzAD8AISAQwBEgCOAEsAJoAUoAtwBhgDVAHtAPsA_QCBwEaARwAlIBcwDFAG0ANwAcQA9ACGwEXgJEATEAnYBQ4CkQF5gMGAYeAyQBnwDTgGsAOCAcoA6MB44iAUAFYAQwA_AEXgJEATsApEBh4DPgHKDIBYAQwAmACOgH2AfgBHAEnAJiAXmAw8BnwDlCkDIABYAFQAMgAcgA-AEAAMgAaAA8gCGAIoATAAngBSAC-AGIAMwAcwA_QCGAIkAUYApQBYgC3AGUANEAasA-wD9AIsARwAlIBQwC5gF5AMUAbQA3AB6AEXgJEAScAnYBQ4C8wGHgMYAZIAz4BrADggHKAPHA.f_gAAAAAAMAA
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 14fdc94b52fb27b36cd596eea225f08cba4b6e7d73bad34e13cf05dd1887ab2d

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
attribution-reporting-register-source: {"source_event_id":"17200521800105346","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 208
content-type: application/javascript; charset=utf-8
date: Wed, 21 May 2025 18:45:37 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 f4cf242caee16dc1ec9b128af4cd10fa Show response
pv.medialead.de/trck/epv/ Frame A9F8 208 B
581 B 108ms
30ms Document
application/javascript 91.121.248.44
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://pv.medialead.de/trck/epv/f4cf242caee16dc1ec9b128af4cd10fa?subid=96568000171247804444550013062011&gdpr=1&consent=1&gdpr_consent=CPOBKPOPOBKPrCnABCDEBwCsAP_AAAAAAAYgH4pd9D7dbXFDefx9Wvt0OYwW1tBXC-QCChSBA2AFQAGQ8LQAk0EaMATAhiACEQIAolIBAAEkHAFEAEAQQIAEAAHsAgSEhAAKIAJEGBERAAIQAAoKAAAAAAAIgABBqASAmAiQS9buRUAAuIgwRApIgAgBCIBHAoMBQAAIAAAIAAIAAACQ0A4AKwAXABDAD8AIKAWkBF4CRAE7AKRAYeAxgBnwDlBUA0AIYATAAuACOAH4ARwAtICQQExALzAYeAz4Byg6COAAsACoAGQAOQAfACAAFwAMgAaAA8AB9AEMARQAmABPACtAFwAXQAvgBiADMAG8AOYAfoBDAESAI4ASwAmABNACjAFKALEAW4AwwBlADRAHtAPsA_QCBgEWAI4ASkAsQBaYC5gLqAXkAxQBtADcAHEAOoAegBDYCLwEggJEATsAocBeYDBgGHgMSAYwAyQBlQDLAGfANOAawA4sBygDowHjgPxIQIAAFgAZABcAEMAJgAXAAvgBiADMAG8ARwAsQBlQD7APwAjgBKQChgFpALmAYoA2gB1AD0AJBASIAk4BbQDDwGJAM-AdGA8clAjAAQAAsADIAHAAPgA8ACIAEwALgAXwAxABmADbAIYAiQBHACjAFKALcAZQA1QB-AEcAJOAWkAuoBigDcAHUAReAkQBeYDDwGWAM-AawEgbAAIAAWABUADIAHIAPABAADIAGgAPIAhgCKAEwAJ4AVgA3gBzAD8AISAQwBEgCOAEsAJoAUoAtwBhgDVAHtAPsA_QCBwEaARwAlIBcwDFAG0ANwAcQA9ACGwEXgJEATEAnYBQ4CkQF5gMGAYeAyQBnwDTgGsAOCAcoA6MB44iAUAFYAQwA_AEXgJEATsApEBh4DPgHKDIBYAQwAmACOgH2AfgBHAEnAJiAXmAw8BnwDlCkDIABYAFQAMgAcgA-AEAAMgAaAA8gCGAIoATAAngBSAC-AGIAMwAcwA_QCGAIkAUYApQBYgC3AGUANEAasA-wD9AIsARwAlIBQwC5gF5AMUAbQA3AB6AEXgJEAScAnYBQ4C8wGHgMYAZIAz4BrADggHKAPHA.f_gAAAAAAMAA
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 4d86ccf7282dbbebc846e2aff053f96e7d44f8ae37a8b3349376757413254840

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
attribution-reporting-register-source: {"source_event_id":"28300521800105184","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 208
content-type: application/javascript; charset=utf-8
date: Wed, 21 May 2025 18:45:37 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 / Show response
adv.office-partner.de/ Frame EB48 930 B
924 B 108ms
31ms Document
text/html 2a0b:4d07:101::1
PROINITY proinity...

General

Check archive.org

Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY proinity GmbH, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 21 May 2025 18:45:37 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 28 May 2025 18:45:37 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 6E7A 2 KB
2 KB 165ms
78ms Script
text/html 18.133.130.200
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=96568000171247804444550013062011&nw=1
Requested by: Host: www.getpaint.net
URL: https://www.getpaint.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.130.200 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-130-200.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 2ed8f98bbbaa12a01636de046d2d4ee6ba1f4346630bc04ed70d882dad1682cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: private, max-age=60
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
expires: Wed, 21 May 2025 18:46:37 GMT
access-control-allow-origin: *
date: Wed, 21 May 2025 18:45:37 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.26
server: nginx
last-modified: Wed, 21 May 2025 18:45:37 GMT
access-control-allow-headers: Authorization

GET
H2

200

activityi;dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364 Show response
5994599.fls.doubleclick.net/ Frame 751F
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364?

2 KB
1 KB

40ms
39ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364?

Requested by

Host: www.getpaint.net
URL: https://www.getpaint.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

2b326af002024eefafa2a1586681c2422f628b6a309b112ca8019cbea2d4939e

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 1018
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:37 GMT
expires: Wed, 21 May 2025 18:45:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900011.redintelligence.net/ Frame 47BC 7 KB
2 KB 52ms
18ms Document
text/html 138.201.64.38
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=3fb0a24720&subid=&uid=551ea1bfeae5b69f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAliQUB8uaNS-BYyViM0P8d6-uASm5b2gaYWVnKfJD_AuEAEgtuHZBGCVgoCAsAfIAQmpAjBIQyhNBbM-qAMByAObBKoE8AFP0O6BXTaI-n288y3JCjM8EXWZ7NoSPK6YkCBPjAap-LpLr1UvOTt4urL0yMWHtl0n2mDVoKZS9lnhzri5qmw3fseRqihWYqHH8dvkkGNzen_Y2_jaXO0p48yX9joY9DczLauy28uvmnkhewavQvsP8Ujt934dZwmvNq-Tu8ygFVoDb_c3W0TxRPqpTZrdzJFwMJn4K_PLhuXvb21rPrIKtrqDEJ4tkGg5BKgtv6kpeliDbyW8FYvPBlzhfAsm4pnFK1Rg8X61HcqxM84-LZrmdWlbT65heKClMDiz_ifsdLnQwT3fXNpED0-uy7vIYBnABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnwEyAooCOg2AQIDAgICAgKiAAqABSL39wTpY4Y2uqpy1jQOACgGYCwHICwGADAGqDQJEReoNEwiRoMeqnLWNAxWMCqIDHXGvD0fwDQGwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyFwQYAioAshgJEgLJThhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzYsX89yYk8_lfOXiu2IS8pdWAc1Vtd4QKKEIsVIY89j7PyBuLQqZ61BEd0mkllkLbyBQSu4LWFqnIKmb6FMUumQQed-5NNIHQkRgB%26sig%3DAOD64_0-5SxjeDrvuSNceQvOXuqWbqJVRQ%26client%3Dca-pub-4343851330510276%26dbm_c%3DAKAmf-DhEkOOmrOxHU8bBv_c0CWJt9_G2Up2XW0hcLYmE2kYx25sIqiJTam45mzxnj7di8DCksPgl9vYy2uCNbdAUZXBDgupROsn-tbSbTF_qcTJpoxjPrcZhT6Oe1ZU_MzkM6eybuaC9R4suddyydDzJWiQzpgDeY-8AvfK5ezvXyOM3dLOc6ZLoQhTRW3MgiYHCY-Y83xtyLLz1lxk_hWlWUmBm1yXw-0-wuBc0Lvcfq065yMO3uSauIdeLEDP_oahASueQ3MpDSMBG-jzoZKF2KnI5dNp0A%26cry%3D1%26dbm_d%3DAKAmf-Cx-mPcgrssJqCR2ave8PmziIO1oKq1UPLbXmq_ljuItbusm7oDTlHq0WgUFv5v5GM-ibCMePUcfi4mA-6UeDm7K5PvQ1UQ3DvYcMI2osT8J-ymVbwhw7MugMoh5KoaZCKSIrGEXngbGJ4W8YT9i5mvnKF6ehz_rYJz8ri5HPZUnUzppQB-me37W8IpWzmvpNqmLkO6f-rm0E9haiEiK7OXq5YGIMdKFpMEbTGdXdln7ZRSKFKwgAfnAwJ5f2J6asmohJExeJX-iTxh7PvXUnWSTCQsje9kOZRvQ-D_4twGyu2FAYmyqod2uEiB26ixuYKF00V0saUTSfAXXOKyocqosPR8rEKF2MWjQcIdKZls7ZIau4kSVX9j8_vtxdurExl7DtbCCUIWkzwOFExog744YI_XXesew6IHQl3JLwRWuu_Dp003Y0KJVdqEBd37LCfuHfvTJHWDlBhC_u0mZ5FjcceMTk_ZRpztwYBS041_KTqIOEs6sTqXDs4_-Iw88kYiC5nsaeZ6PvEWc0oNRIY-ZOMLNvEsXbEb9TAsyWWeyuLRu7fHWRrQTtgMx-H_CAW2BX86PG5siKVYN7lmA8RVhWX4bJsKJib4g4h7b3aD5aznSC8k9C8GUwnozHr5_wVx37YmP9Zui7s6Uw1eMraYPUKBRAFmqZ4FrJAbUjuNqfmMpg0%26adurl%3D&documentReferer=https%3A%2F%2Fwww.getpaint.net%2F&ancestorOrigins=https%3A%2F%2Fwww.getpaint.net&random=7801487009194&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 Mannheim, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f9bdd3e8071b411cc9ad6bb0c4d1af707d90a15b6c18068f79c0c823772c7104

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2053
Content-Type: text/html; charset=utf-8
Date: Wed, 21 May 2025 18:45:37 GMT
Expires: Wed, 21 May 2025 19:45:37 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2

200

native.png
ad-server.eu/wm/pb/ Frame 6E7A
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873f6bc5749724bd084?subid=96568000171247804444550013062011&gdpr=1&consent=1&gdpr_consent=CPOBKPOPOBKPrCnABCDEBwCsAP_AAAAAAAYgH4pd9D7dbXFDefx9Wvt0OYwW...
https://ad-server.eu/wm/pb/native.png

68 B
517 B

96ms
45ms

Image
image/png

2400:52e0:1e00::1080:1
CDN77 Datacamp Li...

General

Check archive.org

Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484
Protocol: H2
Server: 2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
Software: BunnyCDN-DE1-1080 /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cdn-status: 200
cdn-fileserver: 599
date: Wed, 21 May 2025 18:45:37 GMT
cdn-storageserver: DE-51
content-type: image/png
cdn-cachedat: 05/14/2025 13:07:35
last-modified: Sun, 27 Aug 2023 15:45:17 GMT
cdn-requestpullcode: 206
cdn-cache: HIT
cache-control: public, max-age=259200
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: eb0bc7bf-3958-4a46-b210-d6455c22a1c3
cdn-requestid: 9ab3ba53252755a45d334ebbccdd8518
cdn-pullzone: 1577101
cdn-proxyver: 1.27
accept-ranges: bytes
content-length: 68
cdn-edgestorageid: 1080
server: BunnyCDN-DE1-1080
cdn-requestcountrycode: DE

Redirect headers

location: https://ad-server.eu/wm/pb/native.png
proxy-host: pv.medialead.de
access-control-allow-origin
content-length: 0
date: Wed, 21 May 2025 18:45:37 GMT
content-type: application/go
vary: Origin
server: nginx
attribution-reporting-register-source: {"source_event_id":"17200521800105346","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
host: pv.medialead.de

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E7A 0
0 52ms
52ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E7A 0
0 53ms
53ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 6E7A 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5074a1b356532634423736d9e680d3ecb44bdc65436794a2c6a72f6b1c0dca6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E7A 0
0 51ms
50ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 css
fonts.googleapis.com/ Frame 47BC 2 KB
897 B 73ms
30ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf721b4167a3b77f7fcfcc5917b84bb23f90b8bb843443b15e2eabd94117fd77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://hal900011.redintelligence.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:37 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 21 May 2025 17:04:16 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 47BC 20 KB
16 KB 62ms
21ms Image
image/png 88.99.219.174
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank-zinssparen-rolltreppe-1200x627.jpeg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 Ahnsbeck, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 1127beabfee66b7cb5e902d27d1905f94bb4764d01f743f7d2277caf70dadf38

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://hal900011.redintelligence.net/

Response headers

Content-Encoding: gzip
Content-Length: 16426
Date: Wed, 21 May 2025 18:45:37 GMT
Content-Type: image/png
Vary: Accept-Encoding
Server: Apache
Connection: close

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 47BC 19 KB
16 KB 63ms
22ms Image
image/png 88.99.219.174
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/73671/creativesup/DB-Maxblue-1200x627.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 Ahnsbeck, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 6b1cc380ab0b429efc3149745b92676072029c92a7dfe5e954a06f39e76c7ed5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://hal900011.redintelligence.net/

Response headers

Content-Encoding: gzip
Content-Length: 15766
Date: Wed, 21 May 2025 18:45:37 GMT
Content-Type: image/png
Vary: Accept-Encoding
Server: Apache
Connection: close

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 47BC 16 KB
16 KB 60ms
17ms Image
image/png 88.99.219.174
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 Ahnsbeck, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: c777a11761f78b75fadc97702d83b14e4a753a52064797cbe807fbfd6c4623db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://hal900011.redintelligence.net/

Response headers

Content-Encoding: gzip
Content-Length: 16514
Date: Wed, 21 May 2025 18:45:37 GMT
Content-Type: image/png
Vary: Accept-Encoding
Server: Apache
Connection: close

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame EB48 266 KB
93 KB 138ms
85ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c7a3df42a91befb2cdae859a847cdeb4d09178e7dade8741cf025fe9dc8f8817

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://adv.office-partner.de/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1317:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1317:0"}],}
expires: Wed, 21 May 2025 18:45:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:37 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 21 May 2025 18:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1317:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1317:0
content-length: 94094
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK viewability Show response
hal900011.redintelligence.net/ Frame 47BC 0
150 B 53ms
18ms Script
text/html 138.201.64.38
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL: https://hal900011.redintelligence.net/viewability?s=96568000171247804444550013062011&a=013ba5ac&vb=m
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 Mannheim, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://hal900011.redintelligence.net/request_content.php?s=96568000171247804444550013062011&a=a3069140

Response headers

Content-Length: 0
Date: Wed, 21 May 2025 18:45:37 GMT
Content-Type: text/html; charset=UTF-8
Server: Apache
Connection: close

GET
H3 200 dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364
adservice.google.com/ddm/fls/z/ Frame 751F 42 B
63 B 105ms
61ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CN7DgauctY0DFVY7vwQdX40eGA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8115906983775.364?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://5994599.fls.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 21 May 2025 18:45:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 attribution_src_register;crd=Zmxvb2RsaWdodF9jb25maWdfaWQ6IDU5OTQ1OTkKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL2RvdWJsZWNsaWNrLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IENPTlZFUlNJT04KZGVidWdf...
ad.doubleclick.net/ddm/activity/ Frame 751F 42 B
66 B 53ms
53ms Image
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=Zmxvb2RsaWdodF9jb25maWdfaWQ6IDU5OTQ1OTkKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL2RvdWJsZWNsaWNrLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IENPTlZFUlNJT04KZGVidWdfa2V5OiAxNzEyMTUxMjQzNTU1NTU1MjQ1CmN0Y19jb252ZXJzaW9uX2J1Y2tldDogNQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFyY2hldHlwZV9pZDogMTYKYXJjaGV0eXBlX2lkOiAxNwphcmNoZXR5cGVfaWQ6IDE4CmFyY2hldHlwZV9pZDogMTkKYXJjaGV0eXBlX2lkOiAyMAphcmNoZXR5cGVfaWQ6IDIxCmNvbnZlcnNpb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IENPTlZFUlNJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQUNUSVZJVFlfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDYwMzI2NjkKICB9Cn0KY29udmVyc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogQ09OVkVSU0lPTl9ESU1FTlNJT05fQ09OVkVSU0lPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjUtMDUtMjEiCiAgfQp9CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3Nzg3OTgzNjY3Mgp0cmlnZ2VyX2RlZHVwbGljYXRpb25fa2V5OiA0MDk0MjMwOTE4NzQzNTA3MTYzCmdhaWFfbW9kZTogZmFsc2UKZWNob19zZXJ2ZXJfYWN0aW9uOiBFQ0hPX1NFUlZFUl9BQ1RJT05fVVNFX0JFU1RfQVZBSUxBQkxFX0FSQQphZ2dyZWdhdGlvbl9jb29yZGluYXRvcjogQUdHUkVHQVRJT05fQ09PUkRJTkFUT1JfR0NQCmVjaG9fc2VydmVyX3JlbmRlcl9waXhlbDogdHJ1ZQo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://5994599.fls.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Wed, 21 May 2025 18:45:37 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"4094230918743507163"}],"aggregatable_trigger_data":[{"filters":[{"14":["6032669"]}],"key_piece":"0x13bdd6ca8600f02b","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x7b631f3306f0a13b","not_filters":{"14":["6032669"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.gcp.privacysandboxservices.com","debug_key":"1712151243555555245","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"4094230918743507163","filters":[{"14":["6032669"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"4094230918743507163","filters":[{"14":["6032669"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"4094230918743507163","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"4094230918743507163","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["5994599"]}}
content-type: image/gif
x-xss-protection: 0
server: cafe

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6E7A 60 KB
21 KB 99ms
17ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=96568000171247804444550013062011&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: aded6f5d3884b2b76ebb023833622f050eb4a1b7ceaafe8dde56093109bab14a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

x-amz-cf-pop: FRA60-P4
content-encoding: gzip
etag: W/"d27fa6d7a63dc5118a9fc554c342e8d7"
age: 55439
via: 1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: HktymxKq17CGDf7k5DxcuAndyqBweiZnXTSHx6JqIXcyp5xsXlk66w==
date: Wed, 21 May 2025 03:21:39 GMT
content-type: application/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Thu, 15 May 2025 09:11:18 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 6E7A 3 KB
3 KB 60ms
12ms Image
image/png 99.86.4.36
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1747853437&Signature=VfXkrpKRA8w8i-drOh74XbykK5r0ar7TdBnKjGSTO3nV1E6LVa8-K3NN45eDG5JD6QscxtYXVBDEFshZmGYrGeuOwxRG0HNqJQ7eTBXFl~swXiqf8hqGRnPPNWdw7Eck1A78bt49JmBFkY4F6sMmoPxKCARKiG0sKEjWB8BnmrNXfCG5-PO0rEkqDk8K6YcfjZ6LkTI5~B3uBz06AviRW-jbSahSq57MoqTArZFa62rr~Q8xEdoHfISxyqNBt~UW6Bqp2nOVzQGL35XBhT-IMIheYtso6Kfm1fb6FxS8OgFrnj1eQCZQvvcEy5-G7zUC4xmOHYS3VM2U2gXezEFeiQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4343851330510276&output=html&h=90&adk=1691726318&adf=3893112117&w=728&lmt=1747702613&channel=0049261017&ad_type=text_image&format=728x90_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=https%3A%2F%2Fwww.getpaint.net%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1747853135532&bpp=105&bdt=319&idt=152&shv=r20250520&mjsv=m202505150101&ptt=5&saldr=sd&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=336x280_as%2C250x250_as&correlator=6553910538074&frm=20&pv=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1388&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31084127%2C95353386%2C95344788%2C95360958&oid=2&pvsid=4488538373837200&tmod=709022992&uas=0&nvt=1&fc=896&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=484
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-36.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

x-amz-version-id: null
etag: "4e57de0506fbdb487ffcd53b450caee1"
age: 60525
via: 1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2808
x-amz-cf-id: vpxMi6uwt04pyLz7j3yt-UyVgOFpbLRKGBjh1fm5FMvVavBsB8iPgA==
date: Wed, 21 May 2025 01:56:56 GMT
content-type: image/png
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
vary: accept-encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E0B 0
20 B 53ms
52ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bo0tLUB8uaNDyLPDFmLAPwdjj6AQAAAAAOAHgBAI&bg=!7u2l7aLNAAYA59AtIOc7ADQBe5WfOB_KhQrCSSDoRGROge-Od2cmyT6nSu88sOrlybL6MWuocxEZJRtKbirPlJW361QOAgAAAOpSAAAABmgBB34ANebd4XV5QIUMU216E36uu9lmBPhJlk0F8rJP2aTOJp1Il2OjqAC6_ywM0M3kQ9_nb7FktK2jCgBVyuFrN7fr60x6YEXq3-J8UD8-MRS5LvfxwlNVIjdEsEzRoquPn4CB1-Ssl9EEQrv5PloZnQNvBc4Okn1kaxoTvT1DQPMQR48SddtbfsHmEriD_Mt4uZkCfek1SLQW7ZIZ0-HEbEP0Ebvq6kBJcvqYp00KAxgIQavhMh5YZdZ3X_xNytqE23SEmtqhfoYN7aT1EFNq9EUAVaq9Ii7dLJRZ6eALPddQe9m_QsikkWeqGpP8tFu1IKMTxBkvwrs8QYD17rUfY7Tq9YkA5tKm_N9Q5hy5FsVpR1QhX4pZ4Epehtqpa-vpNf7JWScEqvGAVT0mVr6g9CXYFCDIqpFN4yaPh7qxtXB6U5ns5X0pI6G04rTjOl24ja75mIJjd-i79G0eudJPqfSb8sZyf8erf6ZGfbytUOV_4lFLQ74cMKByXbjiZOE3WSgnWrxNwnhoLlbRVw42FRTuwvVcO0G7AITH6g7_oogrrCzPOeE9bZ94GCOJcoeoCXmwA12nfxx4ifS2GMDL5M-mrEUHTrYElrMtb09hBTyLPCSi_wKqW1I9dXwGp90JRKgIoxemdz2cuxMa_uxh_tlIwfdpCkBEkW-ldFFVxyMPNDIcuI4vsc4wxqxsAiXrBPM5XfsdTfGh9Cxu26yUWJd0fFwwR2_31AXdpSSyIEGHLNCLtFYCAoAKXLkreqBfEFGkTt-GiImlMJJUiHQHOoZuv0Gjm9oKvkW3ant3stFM4YzUsSsRw7YWC_RGOSvCbORf0zHsw-PrBlfU8gR35Z3NKNow4ulwRUWriF52HZj8S27yTFAH0AoHW_b1z41rE5VNT_2JUyuQj5hkbgkj21qReqN8abWAgH-v7gpurdQAyTOBPl7s3U8icdIeCAKFgA6v-5rTMpOyspZqRGsW8c7xVtEPRpuHjfa5UgI-bTX90lzvNCtTJbbqh38sxqFVuiZLIKpvbqqsHrCBfJU8G9Y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame EB48 378 KB
127 KB 53ms
51ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&cx=c&gtm=45He55k0v78857208za200&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b78c1252a22dbdea263feae2cba8560e8921d4b4d05eb5036bdae9102b0e8684

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://adv.office-partner.de/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Wed, 21 May 2025 18:45:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:37 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 129275
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3918 42 B
65 B 54ms
54ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsubsALp1T-gcBrnY02QR35VjHoJ8RDQqyWd-LzOBb96PSJ374pRoXQxEMkI6S5A_Zpy96R0aSFMNSUbGfeZVA4UKSJsJ1yRj55wbixtgdaui7WwPH-bLFvf8lP_XTb5Z-qmWNeDau6vtlteGv7U_i5JCpFOLsrlW3IKdcyQoiP79iWB_D1IuLyLhQgvulTyepEyQ4ZB5AI5&sai=AMfl-YTsHOZ6PrpCi_783nf9MDTrpLikM3NBRCyaSVsLRL7HueTMOFwu1Sq63ACGP3AaH0mvsjxs91GOLhzrpW7ZCumJT6sw7Fjy_Uo4YQqOkE-fSwTxbL4T1eXgT4WrgmpYnK7Vbj04otr-pCXS6QXy&sig=Cg0ArKJSzEgwySS04FaFEAE&cid=CAQSTgDZpuyzsLNSNGb5V3mMtvj9QqkHqzpNk9FLn1PTjPCRIgxEEgtgNAtaateniOyqMoobQkPunCfJW5mW9FWXO3n_x_57ShebjIL_Jp3p1BgB&id=lidar2&mcvt=1000&p=0,0,280,336&tm=1063.2000007629395&tu=63.29999923706055&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250519&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=3788282855&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4378593600&rst=1747853136000&rpt=855&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 21 May 2025 18:45:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 90ms
46ms XHR
application/json 142.250.184.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20250520&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

c822583ee29c7cb8b353fb8a1b229978866fb70e5757e4706df09bf301f0f8d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13057
date: Wed, 21 May 2025 18:45:38 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 favicon.ico
www.getpaint.net/ 1 KB
1 KB 180ms
179ms Other
image/x-icon 50.87.184.106
UNIFIEDLAYER-AS-1

General

Check archive.org

Download Go to

Full URL: https://www.getpaint.net/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.184.106 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box2545.bluehost.com
Software: Apache /
Resource Hash: a41af9fc94c96eca79056c2895bd970523f37992ff8dd27bb879e8137b9bd5eb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

cache-control: max-age=604800
expires: Wed, 28 May 2025 18:45:38 GMT
accept-ranges: bytes
content-length: 1406
date: Wed, 21 May 2025 18:45:38 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sat, 13 Jan 2007 22:41:32 GMT
content-type: image/x-icon
server: Apache

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 20 KB
7 KB 95ms
36ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7f65c0446b6cac3175458f6388304d0c23e70d11fa0db20920a619f1bc18623

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

content-encoding: gzip
etag: "1747411493688989"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Wed, 21 May 2025 18:45:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:45:38 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 7188
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/237/ Frame 8030 13 KB
5 KB 64ms
16ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14b660a511e14a9a481c6fe43c576f36c61b656cfd379728c54f1128e1855966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.getpaint.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1877
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5044
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:14:21 GMT
expires: Wed, 21 May 2025 19:04:21 GMT
last-modified: Tue, 13 May 2025 23:17:50 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

aframe Show response
www.google.com/recaptcha/api2/ Frame 44E4
Redirect Chain

https://www.google.com/recaptcha/api2/aframe
https://www.google.com/recaptcha/api2/aframe?hl=en

829 B
570 B

32ms
27ms

Document
text/html

142.250.184.228
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe?hl=en

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f4.1e100.net

Software

ESF /

Resource Hash

4e22a516c3a8fbbb7e7d089aa300482476be9876b068f6c6145f6e217bb56c8d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ezMZSVMTi-6BX3Z-kJw3Ew' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.getpaint.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ezMZSVMTi-6BX3Z-kJw3Ew' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 18:45:38 GMT
expires: Wed, 21 May 2025 18:45:38 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

Location: https://www.google.com/recaptcha/api2/aframe?hl=en
Non-Authoritative-Reason: WebRequest API

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 44E4 0
17 B 50ms
50ms Image
image/ 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=237&li=gda_r20250520&jk=4488538373837200&rc=

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/aframe?hl=en

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:38 GMT
x-xss-protection: 0
content-type: image/
server: cafe

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 6E7A 16 B
209 B 77ms
75ms Fetch
application/json 13.43.191.164
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.191.164 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-43-191-164.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/8.4.5

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, private
x-content-type-options: nosniff
access-control-allow-origin: *
date: Wed, 21 May 2025 18:45:38 GMT
x-xss-protection: 1; mode=block
content-type: application/json
x-powered-by: PHP/8.4.5
server: nginx

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 122ms
25ms Preflight 13.43.191.164
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.191.164 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-191-164.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 21 May 2025 18:45:38 GMT
server: nginx

GET
H3 200 Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js Show response
pagead2.googlesyndication.com/bg/ Frame 8030 54 KB
21 KB 14ms
14ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

59bf1b3d98a046f73f1852acf5aaed1f0080124d087ebeafc7cfb15e5ab1d6ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 153880
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Wed, 20 May 2026 00:00:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 20 May 2025 00:00:58 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21184
x-xss-protection: 0
server: sffe

GET
H2 204 generate_204
ep2.adtrafficquality.google/ Frame 8030 0
40 B 23ms
22ms Image
text/plain 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?gOTu0w
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 21 May 2025 18:45:38 GMT
cross-origin-resource-policy: cross-origin

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E7A 0
20 B 53ms
52ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9794789855968&version=m202505060201&ct=77&x=1&cor=31367525328712572

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 sodar
ep1.adtrafficquality.google/pagead/ 0
17 B 67ms
66ms Image
image/ 142.250.184.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=237&t=2&li=gda_r20250520&jk=4488538373837200&bg=!gIOlg8zNAAYA59AtIOc7ADQBe5WfOLPnT_k6cX0M2OnpqwDGuPFOL6QQ1JAmB0eMWpIjze5dTIENcAb9HGIMbYt15jL3AgAAAIJSAAAABGgBB34ANjxF7LV8At3uR3818hDAWNFzrhWzi1dqpUeYbFKce50tcNnyw_pjqsLn3RDPNyzI2epqUkr9kQoALw38KFez6UEKMCqZTHxfD4CPhO4eIpKVtBAIoUPk4Lh2LGsY7bH4W_geJ-qBy81PmQJlvsQVxFtsiIYWREWFnFFczXaIhsaTT-lde67Cr9rKdDJlHmiweDIkfUKELDVNyCTbEFqGQCmFqJ2HEPrZCHzxbJ0Cx2pw-CrcdML3mtwWN62Xbm9PFBYnl4ySFiPGrMONtCKJrSEmVk0KZiQkjOWYZv3r8wbctO8VrG-u2i52jXAicmF9O0RHyIZ6bOsp5zE1J_JEsEY2C6MYaLpA-N2R6yBE-arGigURbzTrLNNhb_8MIwWlaV1UlQEm9zjRjjE_A0y6Pa_geGNBd4royafqPw0siMVhsr8UWvuPNbW0ufXaLoxNNHt-86Ypd43REkjZ83U8Era_ce3sptw66GtEL_kaocVjCKiiLaNUXEcsoKZu_c6-nwkKiVXzon3TdSpfo_ISzd-JQ9s7pYzocyw4fj0jPQ_koUDQOaZ2vKsCqF90oTVUgn8FX5ekrXKq9Nk4ZrZG9dNY_MmD3C2So4PoUBJGpm3NLq-eg_Vabf-Xf4KO_-VaMujeDA45fRph4O6wI0sjIgyfiTcGWLhQ_4gnSAQdyx1E3O-qCXYqGp0T9aw6c-qatpIfReE6-KS6acKKhf-4QQti5Nw08YbB_eWLrOOUt9OqDRHYx40gtF5b1MVZPRplzC-xxRTz6QAxwAmNQkCxhHmshayuEboqsZWS6iM-miBUc8nAWFv3YIhvedAtDHkdykXwTWwaQVXWVIK9jgvo6dk3VCfMlQI5FWTaaZjq40M4_lY0-CVY8u_wJyuwyQMl78WtxfMJ_TwmvN_rlFxGtAC9GZt2hZTTW7XMvPtxP04sZY0Nh9fDUqH_uLQSDdJVSw

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.getpaint.net/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 21 May 2025 18:45:39 GMT
x-xss-protection: 0
content-type: image/
server: cafe

Verdicts & Comments Add Verdict or Comment

51 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.paypal.com/	1970-01-21 14:16:29	Name: ts Value: vreXpYrS%3D1779389135%26vteXpYrS%3D1747854935%26vr%3Df42a4e681960ad1218a51e8afee8bad8%26vt%3Df42a4e681960ad1218a51e8afee8bad7%26vtyp%3Dnew
.paypal.com/	1970-01-21 14:16:29	Name: ts_c Value: vr%3Df42a4e681960ad1218a51e8afee8bad8%26vt%3Df42a4e681960ad1218a51e8afee8bad7
.getpaint.net/	1970-01-21 14:52:29	Name: __gads Value: ID=559ddff9617eeb72:T=1747853136:RT=1747853136:S=ALNI_MaOpio4h7-QDrazBFH272lLUhbNfQ
.getpaint.net/	1970-01-21 14:52:29	Name: __gpi Value: UID=000010becc83afb4:T=1747853136:RT=1747853136:S=ALNI_MYtckWe1bIYVXVLH8gZ8CUCH3UZ1w
.getpaint.net/	1970-01-21 09:50:05	Name: __eoi Value: ID=438b2785cb394349:T=1747853136:RT=1747853136:S=AA-Afjba4DojUSY1cZ2ueqLSGJ8S
.doubleclick.net/	1970-01-21 14:52:29	Name: IDE Value: AHWqTUkA5VQvfiQYs8xBesff848E2EFbvkAQWfimXoppfJEF0ntVuVtCn8oHZHqV
.casalemedia.com/	1970-01-21 07:40:29	Name: CMPS Value: 5241
.casalemedia.com/	1970-01-21 14:16:29	Name: CMID Value: aC4fULmqPU8AIq54AhPFWgAA
.casalemedia.com/	1970-01-21 07:40:29	Name: CMPRO Value: 3178
.doubleclick.net/	1970-01-21 09:50:05	Name: APC Value: AfxxVi5MM8E7BgmpCqnoT3PONO81DeUIrG-4kYmwhdVmEc_X8TjR1Q
.doubleclick.net/	1970-01-21 09:50:05	Name: receive-cookie-deprecation Value: 1
.doubleclick.net/	1970-01-21 06:14:05	Name: ar_debug Value: 1
.googleadservices.com/	1970-01-21 07:40:29	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-21 05:30:56	Name: DSID Value: NO_DATA
.redintelligence.net/	1970-01-21 07:40:29	Name: 8lcfmzhxc8d6_uid Value: 8aeb6e95e43b50b6
.medialead.de/	1970-01-21 14:16:29	Name: trs Value: 682e1f51c9dedfaf82a77376
.office-partner.de/	1970-01-21 15:06:53	Name: source Value: {"webgains_webgains":{"timestamp":1747853137771,"clickCookie":false}}

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0901C00340B0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0301C00340B0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
ad-server.eu
ad.doubleclick.net
adservice.google.com
adv.office-partner.de
analytics.webgains.io
api.webgains.io
cdn.track.production.webgains.team
cm.g.doubleclick.net
dsum-sec.casalemedia.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal900011.redintelligence.net
pagead2.googlesyndication.com
pv.medialead.de
tpc.googlesyndication.com
track.webgains.com
www.getpaint.net
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.paypal.com
www.paypalobjects.com
104.18.27.193
13.43.191.164
138.201.64.38
142.250.184.194
142.250.184.195
142.250.184.228
142.250.185.142
142.250.185.198
142.250.185.68
142.250.185.98
142.250.186.34
142.250.186.66
142.250.186.70
151.101.1.21
172.217.16.194
172.217.18.1
172.217.18.98
172.64.153.163
18.133.130.200
18.66.147.120
2400:52e0:1e00::1080:1
2a00:1450:4001:810::200a
2a00:1450:4001:810::200e
2a00:1450:4001:812::2008
2a00:1450:4001:81d::2001
2a00:1450:4001:827::2003
2a00:1450:4001:829::2001
2a0b:4d07:101::1
50.87.184.106
88.99.219.174
91.121.248.44
99.86.4.36
00cb7954e81964a084d2b6be31d34dec7e5bc75ce1e5eba690b3cc0b0640b5a9
0b063c61c371f585f55c65d3984b3a5cbba9587b7e05b05035ad46628bda11e1
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
1049ad9ea0d1015b31c6e7bf258d692e9e2f3c16526a27bb4fb0718ca3f3ccbc
1127beabfee66b7cb5e902d27d1905f94bb4764d01f743f7d2277caf70dadf38
14b660a511e14a9a481c6fe43c576f36c61b656cfd379728c54f1128e1855966
14fdc94b52fb27b36cd596eea225f08cba4b6e7d73bad34e13cf05dd1887ab2d
1737c65ad31e5ea7b1cbd8391c03c57c99ac1bca012d2f5a064b137db449465f
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1d57d8320fed6ea14fb1caa564c18bd5bc9f711f4444d275f04bfea41639cc79
21ed7729df820fb932de2e8945df88577acb274de09d25c38e4a857e833f89a9
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
2b326af002024eefafa2a1586681c2422f628b6a309b112ca8019cbea2d4939e
2ed8f98bbbaa12a01636de046d2d4ee6ba1f4346630bc04ed70d882dad1682cf
37d6e43a2137ce49b509abfb8505fa307d0d18c7e335045e737cce79466c4cb9
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
38dc9bc2f3a585d4b754d9119fb3b2a109d1329b401a203583b278ecf9e75561
40d05c659dc6a4356d13d97cdcb989dd708cc48c91ff9eedb2c65e80e8bcd2b9
428327687feab0450cbd7714c88da700e2d525e6b0bf4b42f49f9da6d7bd9a72
428c0da7fa6442eef8923695dcc99c5eb4a049b44109e78076cb3900b13ecfd5
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
4514e63d4ca83723f25d5fb3359e81d630f05a79a8f6e992f8fb7a6b230600bb
4d86ccf7282dbbebc846e2aff053f96e7d44f8ae37a8b3349376757413254840
4e22a516c3a8fbbb7e7d089aa300482476be9876b068f6c6145f6e217bb56c8d
5074a1b356532634423736d9e680d3ecb44bdc65436794a2c6a72f6b1c0dca6e
52335a2acd1c6dac7571132b6ada80e4f854ff592fc35333aa27ce83c7f3b27f
55ce84013276e0eab96b4c52bea296c27c3c9c095c80bb534ac65064c0f6a156
5805f32624dbca80e736d3923c1850f68324439444943173d94e25be31d1508d
59bf1b3d98a046f73f1852acf5aaed1f0080124d087ebeafc7cfb15e5ab1d6ab
5db21ddd8963f75c179a0c265491b962170d1d0978795bbde5cc34ec2cc95a17
5ee2a16d4f8f9629ae75e0f94473f8601a4e0bf9527ba4467a094926e0947505
61dea330474d8c135794901180a689bb4790db7daa0d26b148256e1dee02cbaa
6355a7bcb2412bbb25a722e48636b58b050a7a4af7a68258919f7306e85de618
6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69
65871d0ac7a4d2399b5e6ee462cd1e5906e76b76e030ff4eff1829d2818f817c
6b1cc380ab0b429efc3149745b92676072029c92a7dfe5e954a06f39e76c7ed5
711430320097c0798702214a32954148a32ff546941a6eadd870ab49d18c3213
716e877e57b348fb21a9f741ad7834a97a2dc2ab6d152411328ce0324cfa37e0
7270a088b61596bb9627c37a26da5d97399dee1659443fda484e81609d723921
76494fc583ed81567523f7e7443af01eefc61c87a09314528e8ef91c95ea3076
782e92e85a169f757aa4c30c07e286e5a92e8e8214b1f36f8f2c30cc587b4864
82660ff4649dd25de7a5119726a5876433ef79e41d94456f3f70d93ce780f1a0
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
9b3fc84026e583925171b9ab0deb0d723797d40d17dc7d93b9410fdb8b6316d9
a0316f0fe3fd8c4927a2fcf78579d133ca4eea8f655865aa2ea4182bdaa400fb
a1d01a37fe3411099136b3fbbc9d2cc918bbe6164f9184e9a1cc4e24f614cd7e
a41af9fc94c96eca79056c2895bd970523f37992ff8dd27bb879e8137b9bd5eb
a6d60b6f238de907193114d6f5be305e98be41ac8415a5fad56101f5f4bd55a3
a7f65c0446b6cac3175458f6388304d0c23e70d11fa0db20920a619f1bc18623
a8f36837d21e73e1a17fa2936ec161187b3d1e6b08c0335433aec8153cd41049
aafb777c59d54093f12d271484c6ed79b3c4b85703df5ac5c567993f0509c1a2
adb20dfcb3586b802e692ef1365bac860fd8670b85a67f0286677ac4268b6bd4
aded6f5d3884b2b76ebb023833622f050eb4a1b7ceaafe8dde56093109bab14a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3afa1e54d5383084054107daa76bb0b3d8055068610eedca3ec7308fea81319
b603f5e9cdcaef60acdb78cb0aea63e47738d8dee4fc966b55290fbc5fd430fa
b78c1252a22dbdea263feae2cba8560e8921d4b4d05eb5036bdae9102b0e8684
bb00c75412d0418040c6c941e7798008bc906d2624a929cd9b19ede56db89f83
bf721b4167a3b77f7fcfcc5917b84bb23f90b8bb843443b15e2eabd94117fd77
c08902c3d0dc41d8abf9b9f07bddd9d2efb5c8aa5ed0057b1bb0520d1ea815ff
c131924c3ce72c2cf8f6194f24533f63026d7926346faeee6f97066cf72360b9
c3f8c3da4430d08cda67d76bb22d139eb22bc7f85fb703e2121163dd2ffac787
c55500628a927bb87d2377a685e83c7ef50f73f6339f7ddafb303e82901aeb9f
c777a11761f78b75fadc97702d83b14e4a753a52064797cbe807fbfd6c4623db
c7a3df42a91befb2cdae859a847cdeb4d09178e7dade8741cf025fe9dc8f8817
c822583ee29c7cb8b353fb8a1b229978866fb70e5757e4706df09bf301f0f8d7
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
cc5e49811a56d06c88d67c66e7f9890f27b645d5b7567a81a17ab334c0a4415d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e89bcf6f05af175794448cc77c9f23ed5f79b7678ce88482b05f6b9cebb93fbb
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef83bcc760b0ec83296183735ed7661b5adf5349837fbd77701fa8e3a13d1373
f25b842633f6e03c845782b612b1a3c9166ea3859b9dbdb3dc61dcb5f6b9037a
f3ccb071d95a4f71f35523f1bcf349892a0f88dbb6ffc46df5ab2b6988640043
f4ba7aa30e60bb2f3369ca89c67e259b78f2217b33d86f0592949aca3b059763
f9bdd3e8071b411cc9ad6bb0c4d1af707d90a15b6c18068f79c0c823772c7104
fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

www.getpaint.net Open in urlscan Pro 50.87.184.106 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

105 Requests

93 %HTTPS

25 %IPv6

19 Domains

29 Subdomains

31 IPs

6 Countries

1330 kBTransfer

3275 kBSize

17 Cookies

22 Outgoing links

Page URL History

Redirected requests

105 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.getpaint.net Open in urlscan Pro
50.87.184.106 Public Scan

Screenshot
Live screenshot

Full Image

105
Requests

93 %
HTTPS

25 %
IPv6

19
Domains

29
Subdomains

31
IPs

6
Countries

1330 kB
Transfer

3275 kB
Size

17
Cookies

105 HTTP transactions
2 data transactions